[nick-potts]

Why

Ployz 0.4 lets a Server build a push under an automatic deploy rule without trusting Ployz Cloud. The rule pins a builder by commit. GitHub writes the builder's file and commit into the run's OIDC token (job_workflow_ref, job_workflow_sha), so the Server can check that this builder ran and that the caller added no steps to its job. The composite action at getployz/build@v1 can't be pinned that way, so this adds a reusable workflow next to it.

What it does

.github/workflows/build.yml is a workflow_call with two inputs. cloud is the Ployz Cloud origin. commit is optional and defaults to the commit GitHub ran.

1. Checks out inputs.commit || github.sha with persist-credentials: false. It never checks out a commit Cloud names.
2. Downloads the ployz CLI from PLOYZ_URL and checks it against PLOYZ_SHA256.
3. Turns on Docker's containerd image store.
4. Exposes the Actions cache service (crazy-max/ghaction-github-runtime, pinned by commit). ployz passes it to Buildx only when the rule's policy turns the cache on, and scopes it by the policy's digest.
5. Runs ployz build --cloud --commit --source --events. ployz makes the build's own holder and recipient keys and requests a token for each audience. It opens the build secrets only when the Cluster's attest key sealed them. Buildx gets a fresh environment, so ACTIONS_ID_TOKEN_REQUEST_TOKEN never reaches BuildKit, and ACTIONS_RUNTIME_TOKEN reaches it only when the cache is on.

Every action is pinned by commit.

Before merge

• PLOYZ_URL and PLOYZ_SHA256 point at a lab build of ployz from the Ployz PR that adds ployz build --cloud. Before merge, they move to the first Ployz release that carries it.
• Ployz records this builder's commit as its default pin (BUILDER_SHA). A merge commit or a rebase keeps that commit reachable. A squash merge makes a new one, and Ployz's pin moves to it.

Proof

Live lanes ran against a Ployz Cluster with Device enforcement on, from a lab fork of this branch:

• a push on the approved branch built and pushed its image;
• a run on another branch was refused on ref;
• a caller pinned to another builder commit was refused on job_workflow_sha;
• an Actions cache entry written from another branch was not used.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 00cc6431-b19e-4adf-bcb3-7984058b0646

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn