Add: reusable docker build/test/push workflow with keyless cosign signing - #5
Merged
Merged
Conversation
Extracts the per-image build → test → push chain from
sf-docker-images/build-and-push.yml into a workflow_call workflow, per
sf-docker-images/docs/reusable-workflow-migration-design.md. One invocation
per image; callers fan out with a matrix and keep repo-specific release
logic. Changes vs the source workflow: per-image gha cache scope, two-tag
scheme ({{version}} + latest, rolling major/minor dropped), version-report
artifact for release-note aggregation, README sync behind an
image-description input, all third-party actions SHA-pinned.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The push job now signs the pushed manifest-list digest with cosign (keyless, GitHub OIDC via Fulcio, recorded in Rekor). Requires id-token: write from the calling job. The certificate identity is this workflow's job_workflow_ref — renaming/moving this file invalidates downstream verify commands. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements
sf-docker-images/docs/reusable-workflow-migration-design.md(§4): the per-image build → test → push chain as aworkflow_callworkflow. One invocation per image; callers fan out with a matrix and keep repo-specific release logic local.Deliberate changes vs. the source workflow in sf-docker-images:
id-token: write{{version}}+latestonly (rolling major/minor tags dropped, per design decision)scope=<image-name>) — parallel matrix builds no longer thrash a shared cacheversion-report-<image>artifact: Node/npm/SF CLI/user-plugin versions read from the built image, for the caller's release notesimage-descriptioninput (parity with the live workflow)trivy-versioninput from the design doc dropped —uses:refs cannot take expressions; trivy-action is hard-pinned# vX.Y.ZcommentsVerification
npm run allgreen,actionlintcleansf-ci:test(yields exactly the user-installed plugins)🤖 Generated with Claude Code