From f9926cb91e7266be85f7c10aab8b1c6126ed227f Mon Sep 17 00:00:00 2001 From: Paul Wheeler Date: Wed, 25 Mar 2026 20:14:32 -1000 Subject: [PATCH 01/11] Switch to building and pushing images using portage. --- .custom-gatecheck.yml | 22 ----------------- .github/workflows/delivery.yaml | 44 +++++++++++++-------------------- .portage.yml | 11 --------- 3 files changed, 17 insertions(+), 60 deletions(-) delete mode 100644 .custom-gatecheck.yml diff --git a/.custom-gatecheck.yml b/.custom-gatecheck.yml deleted file mode 100644 index d806e07..0000000 --- a/.custom-gatecheck.yml +++ /dev/null @@ -1,22 +0,0 @@ -version: "1" -gitleaks: - limitEnabled: false -grype: - epssRiskAcceptance: - enabled: true - score: 0.001 - severityLimit: - critical: - enabled: true - limit: 0 - high: - enabled: true - limit: 7 -semgrep: - impactRiskAcceptance: - enabled: true - low: true - severityLimit: - error: - enabled: true - limit: 5 diff --git a/.github/workflows/delivery.yaml b/.github/workflows/delivery.yaml index 56e6d75..941749e 100644 --- a/.github/workflows/delivery.yaml +++ b/.github/workflows/delivery.yaml @@ -33,13 +33,9 @@ jobs: - arch: 'arm64' runs-on: ubuntu-24.04-arm - name: Build, Scan and Publish Images for ${{ matrix.arch }} + name: Build, Scan, and Publish Images for ${{ matrix.arch }} runs-on: ${{ matrix.runs-on }} steps: - # This is needed until we have multi-arch containers for all the steps - - name: Set up QEMU - uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0 - - name: Set up Docker Buildx uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0 with: @@ -77,32 +73,26 @@ jobs: echo "git_commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT echo "git_description=$(git log -1 --pretty=%B | head -n 1 | tr \' _)" >> $GITHUB_OUTPUT - - name: Build and push - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 - with: - platforms: linux/${{ matrix.arch }} - push: true - tags: ${{ steps.vars.outputs.image_name }} - cache-from: "type=local,src=${{ runner.temp }}/.docker-cache" - cache-to: "type=local,dest=${{ runner.temp }}/.docker-cache,mode=max" - build-args: "VERSION=${{ steps.vars.outputs.version }},GIT_COMMIT=${{ steps.vars.outputs.git_commit }},GIT_DESCRIPTION=${{ steps.vars.outputs.git_description }}" - - - name: Build and push podman target - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0 + - name: Build, Scan, and Publish Images (Docker CLI) + uses: easy-up/portage-cd-actions/image-build-scan-publish/docker@main with: - platforms: linux/${{ matrix.arch }} - push: true - tags: ${{ steps.vars.outputs.podman_image_name }} - build-args: "VERSION=${{ steps.vars.outputs.version }},GIT_COMMIT=${{ steps.vars.outputs.git_commit }},GIT_DESCRIPTION=${{ steps.vars.outputs.git_description }}" - target: portage-podman + platform: linux/${{ matrix.arch }} + tag: ${{ steps.vars.outputs.image_name }} + build_args: "VERSION=${{ steps.vars.outputs.version }},GIT_COMMIT=${{ steps.vars.outputs.git_commit }},GIT_DESCRIPTION=${{ steps.vars.outputs.git_description }}" + image_build_cache_from: "type=local,src=${{ runner.temp }}/.docker-cache" + image_build_cache_to: "type=local,dest=${{ runner.temp }}/.docker-cache,mode=max" + deploy_enabled: true - - name: Run Portage CD Scans + - name: Build, Scan, and Publish Images (Podman CLI) uses: easy-up/portage-cd-actions/image-build-scan-publish/docker@main with: - image_build_enabled: false - image_publish_enabled: false - tag: ${{ steps.vars.outputs.image_name }} - maximum_vulnerability_db_age: "1440h" + platform: linux/${{ matrix.arch }} + tag: ${{ steps.vars.outputs.podman_image_name }} + target: portage-podman + build_args: "VERSION=${{ steps.vars.outputs.version }},GIT_COMMIT=${{ steps.vars.outputs.git_commit }},GIT_DESCRIPTION=${{ steps.vars.outputs.git_description }}" + image_build_cache_from: "type=local,src=${{ runner.temp }}/.docker-cache" + image_build_cache_to: "type=local,dest=${{ runner.temp }}/.docker-cache,mode=max" + deploy_enabled: true - name: Store Artifacts uses: actions/upload-artifact@v7 diff --git a/.portage.yml b/.portage.yml index 9fa5fc5..6f28eca 100644 --- a/.portage.yml +++ b/.portage.yml @@ -9,18 +9,12 @@ imageBuild: enabled: true # Enable/Disable the image build pipeline (true/false) buildDir: "." # Build directory for image (e.g. ./cmd/portage) dockerfile: "Dockerfile" # Dockerfile to use (e.g. ./cmd/portage/Dockerfile) - platform: "" # Target platform (e.g. linux/amd64, linux/arm64) - target: "" # Target stage for multi-stage builds (e.g. build, test, publish) - cacheTo: "" # Cache export location (e.g. type=local,dest=path) - cacheFrom: "" # Cache import location (e.g. type=local,src=path) squashLayers: false # Whether to squash layers (true/false) - args: {} # Build arguments (e.g. BUILD_ARGS=--build-arg=key=value) # Image Scan Configuration imageScan: enabled: true # Enable/Disable the image scan pipeline (true/false) syftFilename: "syft-sbom-report.json" # Filename for the syft sbom report (e.g. syft-sbom-report.json) - grypeConfigFilename: "" # Filename for the grype config (e.g. grype-config.json) grypeFilename: "grype-vulnerability-report-full.json" # Filename for the grype vulnerability report (e.g. grype-vulnerability-report-full.json) clamavFilename: "clamav-virus-report.txt" # Filename for the clamav virus report (e.g. clamav-virus-report.txt) @@ -34,7 +28,6 @@ codeScan: # This is overridden in the portage Dockerfile, but is set to false here for runs on local systems # where the standard Python semgrep is installed semgrepExperimental: false # Whether to use the experimental semgrep CLI (true/false) - coverageFile: "" # Externally generated code coverage file semgrepSrcDir: "." # Target directory for semgrep scan (e.g. ./cmd/portage) # Image Publish Configuration @@ -45,7 +38,3 @@ imagePublish: # Deploy Configuration deploy: enabled: false # Enable/Disable the deploy pipeline (true/false). When true, the .gatecheck.yml file is used, otherwise the default gatecheck config is used. - gatecheckConfigFilename: ".custom-gatecheck.yml" # Filename for gatecheck config which specifies the validation rules and limits applied during the deployment process - successWebhooks: - - url: "https://belay-api.dev.holomuatech.online/Build/SubmitArtifacts" # Using the same endpoint from .custom-gatecheck.yml for consistency - authorizationVar: "DEPLOY_WEBHOOK_AUTH_HEADER" # Environment variable containing the auth header value From 6c9c52c918979a14b6cf84b702225553eb2b5e48 Mon Sep 17 00:00:00 2001 From: Paul Wheeler Date: Wed, 25 Mar 2026 21:25:01 -1000 Subject: [PATCH 02/11] debugging issue with buildkit caching. --- .github/workflows/delivery.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/delivery.yaml b/.github/workflows/delivery.yaml index 941749e..e9f079b 100644 --- a/.github/workflows/delivery.yaml +++ b/.github/workflows/delivery.yaml @@ -74,7 +74,7 @@ jobs: echo "git_description=$(git log -1 --pretty=%B | head -n 1 | tr \' _)" >> $GITHUB_OUTPUT - name: Build, Scan, and Publish Images (Docker CLI) - uses: easy-up/portage-cd-actions/image-build-scan-publish/docker@main + uses: easy-up/portage-cd-actions/image-build-scan-publish/docker@buildkit-debug with: platform: linux/${{ matrix.arch }} tag: ${{ steps.vars.outputs.image_name }} @@ -84,7 +84,7 @@ jobs: deploy_enabled: true - name: Build, Scan, and Publish Images (Podman CLI) - uses: easy-up/portage-cd-actions/image-build-scan-publish/docker@main + uses: easy-up/portage-cd-actions/image-build-scan-publish/docker@buildkit-debug with: platform: linux/${{ matrix.arch }} tag: ${{ steps.vars.outputs.podman_image_name }} From cae6b7a9f31deab974382e53db1935627f7c0335 Mon Sep 17 00:00:00 2001 From: Paul Wheeler Date: Thu, 26 Mar 2026 00:33:52 -1000 Subject: [PATCH 03/11] tweak cache key --- .github/workflows/delivery.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/delivery.yaml b/.github/workflows/delivery.yaml index e9f079b..3a792ae 100644 --- a/.github/workflows/delivery.yaml +++ b/.github/workflows/delivery.yaml @@ -45,7 +45,7 @@ jobs: uses: actions/cache@v5 with: path: ${{ runner.temp }}/.docker-cache - key: ${{ runner.os }}-docker-cache + key: ${{ runner.os }}-${{ matrix.arch }}-docker-cache - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0 with: From f0809f685ca79dd30e39965855d21a8813207640 Mon Sep 17 00:00:00 2001 From: Paul Wheeler Date: Thu, 26 Mar 2026 13:22:06 -1000 Subject: [PATCH 04/11] Ignore Docker CLI issue --- .gatecheck.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gatecheck.yml b/.gatecheck.yml index eba79ed..d0d7d93 100644 --- a/.gatecheck.yml +++ b/.gatecheck.yml @@ -6,3 +6,5 @@ grype: cves: # Grype mis-reports this vulnerability which was fixed in clamav >= 0.99.0 even though the apk installed version is >= 1.2.2 - id: CVE-2016-1405 + # Docker CLI issue only affects Windows + - id: CVE-2025-15558 From 23a76ea9b775b0eeed1f64ac4a0b64c614ac0019 Mon Sep 17 00:00:00 2001 From: Paul Wheeler Date: Thu, 26 Mar 2026 14:07:11 -1000 Subject: [PATCH 05/11] Don't fail on semgrep findings since there is no way to ignore specific findings. --- .gatecheck.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.gatecheck.yml b/.gatecheck.yml index d0d7d93..6d54b04 100644 --- a/.gatecheck.yml +++ b/.gatecheck.yml @@ -8,3 +8,15 @@ grype: - id: CVE-2016-1405 # Docker CLI issue only affects Windows - id: CVE-2025-15558 + +semgrep: + impactRiskAcceptance: + enabled: true + low: true + severityLimit: + error: + # Do not error on semgrep findings. There is currently no way to ignore specific semgrep rules or finding instances. + enabled: false + warning: + enabled: true + limit: 0 From 911d81b0ba1d684129334b7f91e94ced19b4da6f Mon Sep 17 00:00:00 2001 From: Paul Wheeler Date: Thu, 26 Mar 2026 22:13:41 -1000 Subject: [PATCH 06/11] Always store artifacts --- .github/workflows/delivery.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/delivery.yaml b/.github/workflows/delivery.yaml index 3a792ae..6b2c2ef 100644 --- a/.github/workflows/delivery.yaml +++ b/.github/workflows/delivery.yaml @@ -95,6 +95,7 @@ jobs: deploy_enabled: true - name: Store Artifacts + if: always() uses: actions/upload-artifact@v7 with: name: build-artifacts-${{ matrix.arch }} From 7690c256752ec22e52d385fe5bb03ffd553e31b0 Mon Sep 17 00:00:00 2001 From: Paul Wheeler Date: Fri, 27 Mar 2026 13:45:39 -1000 Subject: [PATCH 07/11] Ignore some unexploitable vulnerabilities in the buildx plugin and docker cli. --- .gatecheck.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.gatecheck.yml b/.gatecheck.yml index 6d54b04..7482eec 100644 --- a/.gatecheck.yml +++ b/.gatecheck.yml @@ -8,6 +8,15 @@ grype: - id: CVE-2016-1405 # Docker CLI issue only affects Windows - id: CVE-2025-15558 + # Docker Buildx plugin issue (in grpc lib), would only effect a server, we are only using the CLI as a client. + - id: CVE-2026-33186 + # Docker Buildx plugin issue (in opentelementry lib). Not exploitable. + - id: CVE-2026-24051 + # Docker Buildx plugin isshe (in buildkit). Not exploitable since we aren't running or exposing the Buildkit daemon. + - id: CVE-2026-33748 + # No fix available + - id: CVE-2026-2673 + - id: CVE-2026-27135 semgrep: impactRiskAcceptance: From cf54db7973a3cec5e38d69b66974b971a562a6a1 Mon Sep 17 00:00:00 2001 From: Paul Wheeler Date: Fri, 27 Mar 2026 15:49:47 -1000 Subject: [PATCH 08/11] Added Image Push step --- .github/workflows/delivery.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/delivery.yaml b/.github/workflows/delivery.yaml index 6b2c2ef..5990e91 100644 --- a/.github/workflows/delivery.yaml +++ b/.github/workflows/delivery.yaml @@ -101,6 +101,11 @@ jobs: name: build-artifacts-${{ matrix.arch }} path: artifacts/ + - name: Push Docker Images + run: | + docker push ${{ steps.vars.outputs.image_name }} + docker push ${{ steps.vars.outputs.podman_image_name }} + - name: job summary shell: bash run: | From 5a10aa610f296f49c722cdea28573b857e411b3e Mon Sep 17 00:00:00 2001 From: Paul Wheeler Date: Sat, 28 Mar 2026 10:49:18 -1000 Subject: [PATCH 09/11] Updated delivery scripts to expect normal image manifests --- .github/workflows/delivery.yaml | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/.github/workflows/delivery.yaml b/.github/workflows/delivery.yaml index 5990e91..23fd5e1 100644 --- a/.github/workflows/delivery.yaml +++ b/.github/workflows/delivery.yaml @@ -133,18 +133,11 @@ jobs: IMAGE_TAG=${GITHUB_REF/refs\/tags\//} fi # Image Names - # Note: the images produced by the build are acutally manifest lists, so in order to - # combine them into a single multi-platform manifest we need to reference the - # individual components by digest. - AMD64_IMAGE_NAME="$IMAGE_REPO:amd64-$IMAGE_TAG" - ARM64_IMAGE_NAME="$IMAGE_REPO:arm64-$IMAGE_TAG" - echo "amd64_image_name=${IMAGE_REPO}@$(docker buildx imagetools inspect $AMD64_IMAGE_NAME --format '{{json .Manifest}}' | jq -r '.manifests[0].digest')" >> $GITHUB_OUTPUT - echo "arm64_image_name=${IMAGE_REPO}@$(docker buildx imagetools inspect $ARM64_IMAGE_NAME --format '{{json .Manifest}}' | jq -r '.manifests[0].digest')" >> $GITHUB_OUTPUT + echo "amd64_image_name=$IMAGE_REPO:amd64-$IMAGE_TAG" >> $GITHUB_OUTPUT + echo "arm64_image_name=IMAGE_REPO:arm64-$IMAGE_TAG" >> $GITHUB_OUTPUT echo "image_name=$IMAGE_REPO:$IMAGE_TAG" >> $GITHUB_OUTPUT - PODMAN_AMD64_IMAGE_NAME="$IMAGE_REPO:podman-amd64-$IMAGE_TAG" - PODMAN_ARM64_IMAGE_NAME="$IMAGE_REPO:podman-arm64-$IMAGE_TAG" - echo "podman_amd64_image_name=${IMAGE_REPO}@$(docker buildx imagetools inspect $PODMAN_AMD64_IMAGE_NAME --format '{{json .Manifest}}' | jq -r '.manifests[0].digest')" >> $GITHUB_OUTPUT - echo "podman_arm64_image_name=${IMAGE_REPO}@$(docker buildx imagetools inspect $PODMAN_ARM64_IMAGE_NAME --format '{{json .Manifest}}' | jq -r '.manifests[0].digest')" >> $GITHUB_OUTPUT + echo "podman_amd64_image_name=$IMAGE_REPO:podman-amd64-$IMAGE_TAG" >> $GITHUB_OUTPUT + echo "podman_arm64_image_name=$IMAGE_REPO:podman-arm64-$IMAGE_TAG" >> $GITHUB_OUTPUT echo "podman_image_name=$IMAGE_REPO:podman-$IMAGE_TAG" >> $GITHUB_OUTPUT - name: Create and push manifest From 6d3fbd46827206be884914bb454eb5466ed09571 Mon Sep 17 00:00:00 2001 From: Paul Wheeler Date: Sat, 28 Mar 2026 11:27:41 -1000 Subject: [PATCH 10/11] Ignore another Buildkit CVE --- .gatecheck.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.gatecheck.yml b/.gatecheck.yml index 7482eec..3b3aac2 100644 --- a/.gatecheck.yml +++ b/.gatecheck.yml @@ -12,8 +12,9 @@ grype: - id: CVE-2026-33186 # Docker Buildx plugin issue (in opentelementry lib). Not exploitable. - id: CVE-2026-24051 - # Docker Buildx plugin isshe (in buildkit). Not exploitable since we aren't running or exposing the Buildkit daemon. + # Docker Buildx plugin issue (in buildkit). Not exploitable since we aren't running or exposing the Buildkit daemon. - id: CVE-2026-33748 + - id: CVE-2026-34040 # No fix available - id: CVE-2026-2673 - id: CVE-2026-27135 From cf8bf0a61a8f39e50c552809a23a86bc1a535c2f Mon Sep 17 00:00:00 2001 From: Paul Wheeler Date: Sat, 28 Mar 2026 12:12:15 -1000 Subject: [PATCH 11/11] Missing dollar sign --- .github/workflows/delivery.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/delivery.yaml b/.github/workflows/delivery.yaml index 23fd5e1..c930a40 100644 --- a/.github/workflows/delivery.yaml +++ b/.github/workflows/delivery.yaml @@ -134,7 +134,7 @@ jobs: fi # Image Names echo "amd64_image_name=$IMAGE_REPO:amd64-$IMAGE_TAG" >> $GITHUB_OUTPUT - echo "arm64_image_name=IMAGE_REPO:arm64-$IMAGE_TAG" >> $GITHUB_OUTPUT + echo "arm64_image_name=$IMAGE_REPO:arm64-$IMAGE_TAG" >> $GITHUB_OUTPUT echo "image_name=$IMAGE_REPO:$IMAGE_TAG" >> $GITHUB_OUTPUT echo "podman_amd64_image_name=$IMAGE_REPO:podman-amd64-$IMAGE_TAG" >> $GITHUB_OUTPUT echo "podman_arm64_image_name=$IMAGE_REPO:podman-arm64-$IMAGE_TAG" >> $GITHUB_OUTPUT