Sp26 updates by northcutted · Pull Request #25 · northcutted/resume

northcutted · 2026-04-05T19:11:54Z

No description provided.

…ckerfile

…environment variable

Copilot

Pull request overview

Updates the resume content and modernizes the repo’s release/CI supply-chain posture (artifact zipping, provenance attestation, image signing/SBOM), alongside a dependency lockfile refresh.

Changes:

Refresh resume.json (role/title, summary, links, experience bullets, and skills taxonomy).
Add README documentation for SLSA v3 / keyless signing verification steps.
Extend CI/release automation (artifact zipping + provenance attestation) and update the CI container image build/sign flow; add semantic-release config in package.json and update dependencies/lockfile.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
resume.json	Updates resume content (basics, work highlights, skills categories) and adds GitHub profile.
README.md	Adds supply-chain security (SLSA v3) section and verification commands.
package.json	Introduces semantic-release config for GitHub release assets (zip + SBOM files).
package-lock.json	Large dependency tree update consistent with the package.json/config changes.
Dockerfile	Switches to a multi-stage build and Wolfi-based runtime with additional tooling (zip/git/bash) and nonroot user.
.github/workflows/ci.yml	Updates action versions, adds artifact zipping/upload, and adds provenance attestation + SBOM generation in release.
.github/workflows/build-push-ci-image.yml	Updates buildx/QEMU/login actions, adds SBOM/provenance, and signs the pushed image with cosign.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-05T19:15:21Z

          if git rev-parse HEAD~1 >/dev/null 2>&1; then
            # Check for changes in specific files between HEAD~1 and HEAD
-            DIFF=$(git diff --name-only HEAD~1 HEAD | grep -E '^(Dockerfile|package.json|package-lock.json)$' || true)
+            DIFF=$(git diff --name-only HEAD~1 HEAD | grep -E '^(Dockerfile|package.json|package-lock.json|build-push-ci-image.yml)$' || true)


The Docker-change detector greps for build-push-ci-image.yml at the repo root, but the workflow file lives under .github/workflows/. As written, edits to .github/workflows/build-push-ci-image.yml won’t flip CHANGED to true, so the CI image may not rebuild when this workflow changes. Update the grep to match the correct path (and/or use a path-based filter action).

Suggested change

DIFF=$(git diff --name-only HEAD~1 HEAD | grep -E '^(Dockerfile|package.json|package-lock.json|build-push-ci-image.yml)$' || true)

DIFF=$(git diff --name-only HEAD~1 HEAD | grep -E '^(Dockerfile|package.json|package-lock.json|\.github/workflows/build-push-ci-image\.yml)$' || true)

Copilot · 2026-04-05T19:15:22Z

+  "release": {
+    "plugins": [
+      "@semantic-release/commit-analyzer",
+      "@semantic-release/release-notes-generator",
+      "@semantic-release/changelog",
+      [
+        "@semantic-release/github",
+        {
+          "assets": [
+            {"path": "resume-artifacts.zip", "label": "Resume Artifacts (ZIP)"},
+            {"path": "sbom.spdx.json", "label": "Container Image SBOM (SPDX)"},
+            {"path": "sbom.cyclonedx.json", "label": "Container Image SBOM (CycloneDX)"}
+          ]
+        }
+      ],
+      "@semantic-release/git"
+    ]
+  },


This adds a release config to package.json, but the repo already has a .releaserc semantic-release configuration. semantic-release will load only one config source; adding release here can unintentionally override the existing .releaserc settings (e.g., branches: ["main"] and the configured @semantic-release/git message/assets), potentially breaking releases. Consolidate semantic-release config into a single place (either keep .releaserc and remove this block, or migrate the full config here).

Suggested change

"release": {

"plugins": [

"@semantic-release/commit-analyzer",

"@semantic-release/release-notes-generator",

"@semantic-release/changelog",

[

"@semantic-release/github",

{

"assets": [

{"path": "resume-artifacts.zip", "label": "Resume Artifacts (ZIP)"},

{"path": "sbom.spdx.json", "label": "Container Image SBOM (SPDX)"},

{"path": "sbom.cyclonedx.json", "label": "Container Image SBOM (CycloneDX)"}

]

}

],

"@semantic-release/git"

]

},

Copilot · 2026-04-05T19:15:22Z

@@ -13,11 +13,35 @@
 ![GitHub Actions Workflow Status](https://img.shields.io/github/actions/workflow/status/northcutted/resume/ci.yml?style=for-the-badge)
 [![License](https://img.shields.io/github/license/northcutted/resume?style=for-the-badge)](LICENSE)
 [![Security: Dependabot](https://img.shields.io/badge/Securtiy-dependabot-0077c2?style=for-the-badge&logo=dependabot&logoColor=white)](https://github.com/dependabot)


Typo in the badge label: Securtiy should be Security to avoid publishing a misspelled badge in the README.

Suggested change

[![Security: Dependabot](https://img.shields.io/badge/Securtiy-dependabot-0077c2?style=for-the-badge&logo=dependabot&logoColor=white)](https://github.com/dependabot)

[![Security: Dependabot](https://img.shields.io/badge/Security-dependabot-0077c2?style=for-the-badge&logo=dependabot&logoColor=white)](https://github.com/dependabot)

Copilot · 2026-04-05T19:15:22Z

+
+This project embraces zero-trust and secure-by-default architecture. All release artifacts and container images are cryptographically signed and attested to meet **SLSA Level 3** capabilities entirely via GitHub Actions. 
+
+*   **Keyless Signing:** The official builder image (`ghcr.io/northcutted/resume-ci`) is signed with Sigstore/Cosign via GitHub Action's OIDC identity.


Grammar: “GitHub Action's OIDC identity” should be “GitHub Actions' OIDC identity” (plural possessive) since it refers to GitHub Actions as a product.

Suggested change

* **Keyless Signing:** The official builder image (`ghcr.io/northcutted/resume-ci`) is signed with Sigstore/Cosign via GitHub Action's OIDC identity.

* **Keyless Signing:** The official builder image (`ghcr.io/northcutted/resume-ci`) is signed with Sigstore/Cosign via GitHub Actions' OIDC identity.

Copilot · 2026-04-05T19:15:23Z

-        "**JVM Middleware Innovation:** Delivered a tool integrated into base image designed to optimize heap sizing and garbage collection for JVM applications on Kubernetes, significantly improving stability and reducing cognitive load for teams migrating from legacy platforms.",
-        "**Security Automation:** Slashed vulnerability remediation time to **under 24 hours** (down from days) by implementing automated patching pipelines.",
+        "**Enterprise Scale & Adoption:** Scaled adoption from zero to over **700 unique applications** leveraging official enterprise container images in 2025, used in over **100,000 image builds**.",
+        "**Distroless & Multi-Runtime Platform:** Designed and maintain distroless base images comparable to Google's distroless offering, drastically reducing the attack surface. Built on Amazon Linux 2023 libraries for broad compatibility. Expanded runtime support to include **Java/JVM, Javascript/Typescript, Python, Go and .NET**, delivering a secure-by-default multi-runtime image ecosystem.",


Grammar agreement: “Designed and maintain distroless base images …” should be either present tense (“Design and maintain …”) or past tense (“Designed and maintained …”) for consistency.

Suggested change

"**Distroless & Multi-Runtime Platform:** Designed and maintain distroless base images comparable to Google's distroless offering, drastically reducing the attack surface. Built on Amazon Linux 2023 libraries for broad compatibility. Expanded runtime support to include **Java/JVM, Javascript/Typescript, Python, Go and .NET**, delivering a secure-by-default multi-runtime image ecosystem.",

"**Distroless & Multi-Runtime Platform:** Designed and maintained distroless base images comparable to Google's distroless offering, drastically reducing the attack surface. Built on Amazon Linux 2023 libraries for broad compatibility. Expanded runtime support to include **Java/JVM, Javascript/Typescript, Python, Go and .NET**, delivering a secure-by-default multi-runtime image ecosystem.",

Copilot · 2026-04-05T19:15:23Z

+# Builder stage to download and extract Pandoc binary securely
+FROM alpine:3.19 AS builder
 ARG PANDOC_VERSION
 ARG TARGETARCH

-RUN apt-get update && apt-get install -y --no-install-recommends \
+RUN apk add --no-cache curl tar gzip
+
+RUN if [ "$TARGETARCH" = "arm64" ]; then ARCH="arm64"; else ARCH="amd64"; fi && \
+    curl -L https://github.com/jgm/pandoc/releases/download/${PANDOC_VERSION}/pandoc-${PANDOC_VERSION}-linux-${ARCH}.tar.gz -o /tmp/pandoc.tar.gz && \
+    tar -xzf /tmp/pandoc.tar.gz -C /tmp && \
+    mv /tmp/pandoc-${PANDOC_VERSION}/bin/pandoc /usr/bin/pandoc


The comment says the Pandoc download/extract is done “securely”, but the build does not verify the downloaded artifact (checksum/signature) and curl doesn’t fail the build on HTTP errors by default. Consider adding --fail --show-error and verifying a published SHA256 (or Sigstore verification) before installing the binary, or reword the comment to avoid overstating security.

Copilot · 2026-04-05T19:15:23Z

+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v4.1.1
      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}


Step name is misleading: this logs into GitHub Container Registry (ghcr.io), not DockerHub. Rename the step to avoid confusion when debugging auth issues.

github-actions · 2026-04-05T19:43:59Z

🎉 This PR is included in version 2.6.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

northcutted added 8 commits April 5, 2026 13:10

fix: Q2 2026 Updates

d3abf9f

refactor: remove Trivy vulnerability scanner step from CI workflow

e841da5

testing

ae656ab

fix: update builder image to alpine and streamline dependencies in Do…

9318435

…ckerfile

feat: enhance CI/CD workflows with SLSA v3 support and artifact signing

b94f5d6

fix: add missing permissions for id-token in CI workflow

08c5e51

chore: update action versions in CI workflows and remove unnecessary …

8717951

…environment variable

fix: add zip package to Dockerfile dependencies

5bf52c1

northcutted requested a review from Copilot April 5, 2026 19:12

Copilot started reviewing on behalf of northcutted April 5, 2026 19:12

View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

chore: pr review changes

3bde940

northcutted merged commit 823b79e into main Apr 5, 2026
7 checks passed

github-actions Bot added the released label Apr 5, 2026

Navigation Menu

Repository navigation

Sp26 updates - #25

Sp26 updates#25
northcutted merged 9 commits into
mainfrom
SP26-Updates

northcutted commented Apr 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Copilot AI Apr 5, 2026

Uh oh!

Uh oh!

github-actions Bot commented Apr 5, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	DIFF=$(git diff --name-only HEAD~1 HEAD \| grep -E '^(Dockerfile\|package.json\|package-lock.json\|build-push-ci-image.yml)$' \|\| true)
	DIFF=$(git diff --name-only HEAD~1 HEAD \| grep -E '^(Dockerfile\|package.json\|package-lock.json\|\.github/workflows/build-push-ci-image\.yml)$' \|\| true)

	[![Security: Dependabot](https://img.shields.io/badge/Securtiy-dependabot-0077c2?style=for-the-badge&logo=dependabot&logoColor=white)](https://github.com/dependabot)
	[![Security: Dependabot](https://img.shields.io/badge/Security-dependabot-0077c2?style=for-the-badge&logo=dependabot&logoColor=white)](https://github.com/dependabot)


		This project embraces zero-trust and secure-by-default architecture. All release artifacts and container images are cryptographically signed and attested to meet SLSA Level 3 capabilities entirely via GitHub Actions.

		* Keyless Signing: The official builder image (`ghcr.io/northcutted/resume-ci`) is signed with Sigstore/Cosign via GitHub Action's OIDC identity.

	"Distroless & Multi-Runtime Platform: Designed and maintain distroless base images comparable to Google's distroless offering, drastically reducing the attack surface. Built on Amazon Linux 2023 libraries for broad compatibility. Expanded runtime support to include Java/JVM, Javascript/Typescript, Python, Go and .NET, delivering a secure-by-default multi-runtime image ecosystem.",
	"Distroless & Multi-Runtime Platform: Designed and maintained distroless base images comparable to Google's distroless offering, drastically reducing the attack surface. Built on Amazon Linux 2023 libraries for broad compatibility. Expanded runtime support to include Java/JVM, Javascript/Typescript, Python, Go and .NET, delivering a secure-by-default multi-runtime image ecosystem.",

Conversation

northcutted commented Apr 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Apr 5, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants