Copa hardened fixes#259
Merged
Merged
Conversation
…the job) A Copa-patch/gate failure now skips only the -hardened tag for that variant and surfaces a ::warning:: + step-summary entry, instead of failing the whole leg. Plain images already shipped, and some stable lines (e.g. EOL Debian bullseye, whose fixed packages are no longer served) can never be fully patched -- those must not turn the pipeline red. Hardened publishing is best-effort. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
oras (unlike the docker CLI) does not default a bare 'repo/name:tag' to docker.io -- it reads the first path segment as the registry host, so 'pimcore/pimcore:tag' became a DNS lookup of host 'pimcore' and every Docker Hub SBOM attach silently failed (only ghcr.io referrers landed). Prefix docker.io/ for bare refs; leave refs that already carry a registry host (ghcr.io/..., localhost:5000/...) untouched. Fixes plain, hardened, and logical-multiarch-tag attaches at once. Mutation-verified. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Makes hardened-image publishing best-effort and fixes SBOM attachment for Docker Hub references.
Changes:
- Reports severity-gate failures without failing releases.
- Qualifies Docker Hub references for ORAS.
- Adds SBOM attachment tests.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.github/workflows/release.yml |
Makes hardened gate failures non-fatal. |
.github/scripts/attach-sbom.sh |
Adds registry qualification logic. |
.github/scripts/tests/run.sh |
Tests qualified ORAS references. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Addresses review feedback on the docker.io-qualification heuristic: - single-component refs (no slash, e.g. alpine:latest) are official images -> docker.io/library/<ref> (previously the tag colon matched *:* and the ref was left unqualified -> invalid for oras). - localhost is a registry host -> left as-is (previously rewritten to docker.io/localhost/...). localhost:5000/... already matched via the port colon. Our own refs (pimcore/pimcore:tag -> docker.io/..., ghcr.io/... unchanged) are unaffected. Added regression tests for both edge cases. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixex for copa patching
This pull request improves the reliability of attaching SBOMs (Software Bill of Materials) to container images by ensuring registry references are correctly qualified, particularly for Docker Hub images. It also updates test coverage for these changes and clarifies severity gate reporting in the release workflow.
Registry reference qualification and SBOM attachment:
.github/scripts/attach-sbom.shto automatically prefix bare Docker Hub image references withdocker.io/, ensuring theorastool resolves and authenticates against the correct registry. References already containing a registry host (likeghcr.ioorlocalhost:5000) are left unchanged.Test updates for registry qualification:
.github/scripts/tests/run.shto verify that bare Docker Hub references are correctly qualified withdocker.io/fororas, and that references already containing a registry host remain unaltered..github/scripts/tests/run.shto expectdocker.io/-qualified references in SBOM attachment logs, reflecting the new qualification logic.Release workflow improvements:
.github/workflows/release.ymlto clarify that severity gate failures for hardened images only skip the-hardenedtag and do not fail the entire job. Failures are now reported as warnings, ensuring that plain images are still published even when some variants fail the gate.