name: Qualify CSO Scanner Images # Branch dispatches may validate reviewed inputs. Only protected main and the # cso-scanner-release environment may publish or qualify scanner images. An # explicit promotion input may then propose a catalog. on: workflow_dispatch: inputs: promote_catalog: description: Open a reviewed scanner catalog promotion PR after every gate passes required: false default: false type: boolean permissions: contents: read concurrency: group: cso-scanner-images-${{ github.ref }} cancel-in-progress: false jobs: reviewed-inputs: runs-on: ubuntu-24.04 outputs: matrix: ${{ steps.inputs.outputs.matrix }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: 1.4.0 - name: Prove scanner normalization and fail-closed behavior run: | set -eu bun install --frozen-lockfile --ignore-scripts bun test --max-concurrency 1 test/cso-scanners.test.ts test/cso-scanner-executor.test.ts test/cso-scanner-release.test.ts - name: Validate complete reviewed scanner inputs id: inputs run: | set -eu matrix="$(bun run scripts/cso-scanner-matrix.ts)" printf 'matrix=%s\n' "$matrix" >> "$GITHUB_OUTPUT" stage-and-qualify: needs: reviewed-inputs if: github.ref == 'refs/heads/main' && github.event_name == 'workflow_dispatch' environment: cso-scanner-release strategy: fail-fast: false matrix: ${{ fromJSON(needs.reviewed-inputs.outputs.matrix) }} runs-on: ${{ matrix.runner }} timeout-minutes: 45 permissions: contents: read packages: write id-token: write attestations: write artifact-metadata: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: 1.4.0 - name: Require native Docker and the declared architecture env: CSO_ARCH: ${{ matrix.arch }} run: | set -eu case "$CSO_ARCH:$(uname -m)" in amd64:x86_64|arm64:aarch64) ;; *) echo 'Native architecture mismatch; emulation cannot qualify a scanner.' >&2; exit 1 ;; esac docker --host unix:///var/run/docker.sock info - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4 - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Verify reviewed upstream and SBOM-generator attestations env: GH_TOKEN: ${{ github.token }} CSO_BASE_ATTESTATION: ${{ toJSON(matrix.baseAttestation) }} CSO_SBOM_GENERATOR: ${{ toJSON(matrix.sbomGenerator) }} run: | set -eu verify_reviewed_image() { declaration="$1" label="$2" printf '%s\n' "$declaration" > "$label-declaration.json" image="$(jq -r '.image' "$label-declaration.json")" repository="$(jq -r '.repository' "$label-declaration.json")" repository="${repository#https://github.com/}" source_commit="$(jq -r '.sourceCommit' "$label-declaration.json")" signer_workflow="$(jq -r '.signerWorkflow' "$label-declaration.json")" signer_digest="$(jq -r '.signerDigest' "$label-declaration.json")" subject_sha256="${image##*@sha256:}" gh attestation verify "oci://$image" --repo "$repository" --signer-workflow "$signer_workflow" --signer-digest "$signer_digest" --source-digest "$source_commit" --deny-self-hosted-runners --predicate-type https://slsa.dev/provenance/v1 --format json > "$label-provenance-verification.json" actual_provenance="$(bun run scripts/cso-attestation-evidence.ts digest "$label-provenance-verification.json" https://slsa.dev/provenance/v1 "$subject_sha256")" test "$actual_provenance" = "$(jq -r '.provenanceStatementDigest' "$label-declaration.json")" gh attestation verify "oci://$image" --repo "$repository" --signer-workflow "$signer_workflow" --signer-digest "$signer_digest" --source-digest "$source_commit" --deny-self-hosted-runners --predicate-type https://spdx.dev/Document/v2.3 --format json > "$label-sbom-verification.json" actual_sbom="$(bun run scripts/cso-attestation-evidence.ts digest "$label-sbom-verification.json" https://spdx.dev/Document/v2.3 "$subject_sha256")" test "$actual_sbom" = "$(jq -r '.sbomStatementDigest' "$label-declaration.json")" } verify_reviewed_image "$CSO_BASE_ATTESTATION" upstream-base verify_reviewed_image "$CSO_SBOM_GENERATOR" sbom-generator - name: Compile the trusted loopback assertion verifier run: | bun build --compile \ --no-compile-autoload-dotenv \ --no-compile-autoload-bunfig \ --no-compile-autoload-tsconfig \ --no-compile-autoload-package-json \ lib/cso/verifier.ts --outfile lib/cso/images/gstack-cso-verifier - name: Choose the immutable scanner repository id: image env: CSO_SCANNER: ${{ matrix.scanner }} CSO_ARCH: ${{ matrix.arch }} run: | set -eu name="ghcr.io/${GITHUB_REPOSITORY,,}/cso-scanners/$CSO_SCANNER-$CSO_ARCH" printf 'name=%s\n' "$name" >> "$GITHUB_OUTPUT" printf 'tag=%s:%s-%s\n' "$name" "$GITHUB_SHA" "$GITHUB_RUN_ID" >> "$GITHUB_OUTPUT" - name: Build native scanner wrapper with SBOM and provenance id: build uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 with: context: lib/cso file: lib/cso/scanner-images/scanner.Dockerfile platforms: ${{ matrix.platform }} build-args: | BASE_IMAGE=${{ matrix.baseImage }} SCANNER_EXECUTABLE=${{ matrix.scannerExecutable }} tags: ${{ steps.image.outputs.tag }} push: true provenance: mode=max attests: type=sbom,generator=${{ matrix.sbomGenerator.image }} - name: Extract and validate the wrapper SBOM env: CSO_IMAGE: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }} run: | set -eu docker buildx imagetools inspect "$CSO_IMAGE" --format '{{ json .SBOM.SPDX }}' > sbom.spdx.json jq -e '.spdxVersion == "SPDX-2.3" and (.packages | type == "array")' sbom.spdx.json - name: Sign build provenance uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 with: subject-name: ${{ steps.image.outputs.name }} subject-digest: ${{ steps.build.outputs.digest }} push-to-registry: true - name: Sign the image SBOM uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 with: subject-name: ${{ steps.image.outputs.name }} subject-digest: ${{ steps.build.outputs.digest }} sbom-path: sbom.spdx.json push-to-registry: true - name: Verify branch-bound provenance and SBOM identities env: GH_TOKEN: ${{ github.token }} CSO_IMAGE: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }} run: | set -eu signer="https://github.com/$GITHUB_REPOSITORY/.github/workflows/cso-scanner-images.yml@$GITHUB_REF" gh attestation verify "oci://$CSO_IMAGE" --repo "$GITHUB_REPOSITORY" --cert-identity "$signer" --source-ref "$GITHUB_REF" --source-digest "$GITHUB_SHA" --deny-self-hosted-runners --predicate-type https://slsa.dev/provenance/v1 --format json > provenance-verification.json gh attestation verify "oci://$CSO_IMAGE" --repo "$GITHUB_REPOSITORY" --cert-identity "$signer" --source-ref "$GITHUB_REF" --source-digest "$GITHUB_SHA" --deny-self-hosted-runners --predicate-type https://spdx.dev/Document/v2.3 --format json > sbom-verification.json - name: Require a public package and anonymously load the verified immutable image env: GH_TOKEN: ${{ github.token }} CSO_IMAGE: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }} CSO_PLATFORM: ${{ matrix.platform }} run: | set -euo pipefail bun run scripts/cso-public-ghcr.ts verify \ --image "$CSO_IMAGE" --platform "$CSO_PLATFORM" \ --repository "$GITHUB_REPOSITORY" --output public-image.json - name: Recompute immutable rule or database content env: CSO_IMAGE: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }} CSO_ASSETS: ${{ toJSON(matrix.assets) }} run: | set -eu printf '%s\n' "$CSO_ASSETS" > declared-assets.json asset_path="$(jq -r '.semgrepRules.path // .advisoryDatabase.path // empty' declared-assets.json)" expected="$(jq -r '.semgrepRules.sha256 // .advisoryDatabase.contentSha256 // empty' declared-assets.json)" if test -n "$asset_path"; then case "$asset_path" in /policy/catalog/*|/opt/cso/scanner-data/*) ;; *) exit 1 ;; esac container="$(docker --host unix:///var/run/docker.sock create --pull=never "$CSO_IMAGE" /bin/true)" trap 'docker --host unix:///var/run/docker.sock rm --force "$container" >/dev/null 2>&1 || true' EXIT docker --host unix:///var/run/docker.sock cp "$container:$asset_path" scanner-asset actual="$(bun run scripts/cso-scanner-catalog.ts hash-asset scanner-asset)" test "$actual" = "$expected" docker --host unix:///var/run/docker.sock rm --force "$container" >/dev/null trap - EXIT else test "$CSO_ASSETS" = null fi - name: Compile the helper and bind the staged profile env: CSO_IMAGE: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }} CSO_SCANNER: ${{ matrix.scanner }} CSO_PLATFORM: ${{ matrix.platform }} CSO_VERSION: ${{ matrix.version }} CSO_CAPABILITIES: ${{ toJSON(matrix.capabilities) }} CSO_ASSETS: ${{ toJSON(matrix.assets) }} CSO_APPLICATION_EXECUTABLE: ${{ matrix.applicationExecutable }} run: | set -eu bun install --frozen-lockfile --ignore-scripts bun run build:cso policy_hash="$(bun -e "import {ISOLATION_POLICY_HASH} from './lib/cso/docker'; process.stdout.write(ISOLATION_POLICY_HASH)")" jq -n --arg scanner "$CSO_SCANNER" --arg image "$CSO_IMAGE" --arg platform "$CSO_PLATFORM" --arg version "$CSO_VERSION" --arg policy "$policy_hash" --arg app "$CSO_APPLICATION_EXECUTABLE" --argjson capabilities "$CSO_CAPABILITIES" --argjson assets "$CSO_ASSETS" '{scanner:$scanner,image:$image,platform:$platform,version:$version,isolationPolicyHash:$policy,capabilities:$capabilities,assets:$assets,applicationExecutable:$app}' > staged-profile.json - name: Exercise common containment and the real scanner adapter env: GSTACK_CSO_DOCKER_TESTS: "1" GSTACK_CSO_SCANNER_DOCKER_TESTS: "1" GSTACK_CSO_SCANNER_PROFILE: ${{ github.workspace }}/staged-profile.json GSTACK_CSO_SCANNER_VERSION_HASH: ${{ github.workspace }}/version.sha256 DOCKER_HOST: unix:///var/run/docker.sock run: | set -eu bun test --max-concurrency 1 test/cso-docker-integration.test.ts bun test --max-concurrency 1 test/cso-scanner-docker-integration.test.ts - name: Emit one immutable qualified profile env: CSO_IMAGE: ${{ steps.image.outputs.name }}@${{ steps.build.outputs.digest }} CSO_SCANNER: ${{ matrix.scanner }} CSO_ARCH: ${{ matrix.arch }} CSO_PLATFORM: ${{ matrix.platform }} CSO_VERSION: ${{ matrix.version }} CSO_CAPABILITIES: ${{ toJSON(matrix.capabilities) }} CSO_ASSETS: ${{ toJSON(matrix.assets) }} CSO_UPSTREAM: ${{ toJSON(matrix.baseAttestation) }} CSO_SBOM_GENERATOR: ${{ toJSON(matrix.sbomGenerator) }} run: | set -eu policy_hash="$(jq -r '.isolationPolicyHash' staged-profile.json)" version_hash="$(cat version.sha256)" sbom_digest="sha256:$(sha256sum sbom.spdx.json | cut -d' ' -f1)" provenance_digest="sha256:$(sha256sum provenance-verification.json | cut -d' ' -f1)" qualified_at="$(date -u +%Y-%m-%dT%H:%M:%S.000Z)" workflow="https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" version_id="$(printf '%s' "$CSO_VERSION" | tr '[:upper:]+' '[:lower:]-' | tr -cd 'a-z0-9._-')" profile_id="$CSO_SCANNER-$version_id-$CSO_ARCH" output="$CSO_SCANNER-$CSO_ARCH.json" jq -n --arg id "$profile_id" --arg scanner "$CSO_SCANNER" --arg platform "$CSO_PLATFORM" --arg image "$CSO_IMAGE" --arg version "$CSO_VERSION" --arg versionHash "$version_hash" --arg policy "$policy_hash" --arg qualifiedAt "$qualified_at" --arg sourceCommit "$GITHUB_SHA" --arg workflow "$workflow" --arg sbomDigest "$sbom_digest" --arg provenanceDigest "$provenance_digest" --argjson capabilities "$CSO_CAPABILITIES" --argjson assets "$CSO_ASSETS" '{id:$id,scanner:$scanner,state:"qualified",platform:$platform,image:$image,entrypoint:"/opt/cso/entrypoint",executable:"/opt/cso/bin/scanner",version:$version,versionOutputSha256:$versionHash,helperAbi:3,isolationPolicyHash:$policy,capabilities:$capabilities} + (if $assets == null then {} else {assets:$assets} end) + {qualifiedAt:$qualifiedAt,qualification:{sourceCommit:$sourceCommit,workflow:$workflow,sbomDigest:$sbomDigest,provenanceDigest:$provenanceDigest,verifiedProvenance:true,containmentPassed:true,adapterContractPassed:true,offlineAssetsPassed:true}}' > "$output" printf '%s\n' "$CSO_UPSTREAM" > upstream-evidence.json printf '%s\n' "$CSO_SBOM_GENERATOR" > sbom-generator-evidence.json sha256sum "$output" staged-profile.json version.sha256 declared-assets.json public-image.json sbom.spdx.json provenance-verification.json sbom-verification.json upstream-evidence.json sbom-generator-evidence.json upstream-base-*-verification.json sbom-generator-*-verification.json > evidence.sha256 - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: cso-scanner-profile-${{ matrix.scanner }}-${{ matrix.arch }} path: | ${{ matrix.scanner }}-${{ matrix.arch }}.json staged-profile.json version.sha256 declared-assets.json public-image.json sbom.spdx.json provenance-verification.json sbom-verification.json upstream-evidence.json sbom-generator-evidence.json upstream-base-declaration.json upstream-base-provenance-verification.json upstream-base-sbom-verification.json sbom-generator-declaration.json sbom-generator-provenance-verification.json sbom-generator-sbom-verification.json evidence.sha256 if-no-files-found: error retention-days: 30 catalog-proposal: needs: [reviewed-inputs, stage-and-qualify] runs-on: ubuntu-24.04 permissions: contents: read actions: read steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: persist-credentials: false - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: 1.4.0 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: pattern: cso-scanner-profile-* path: qualified-artifacts - name: Assemble and validate the complete catalog proposal run: | set -eu mkdir qualified-fragments find qualified-artifacts -mindepth 2 -maxdepth 2 -type f \( -name '*-amd64.json' -o -name '*-arm64.json' \) | sort | while IFS= read -r file; do cp "$file" qualified-fragments/; done test "$(find qualified-fragments -type f -name '*.json' | wc -l | tr -d ' ')" -eq 12 revision="cso-scanners-$(printf '%s' "$GITHUB_SHA" | cut -c1-12)-$GITHUB_RUN_ID" workflow="https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" image_prefix="ghcr.io/${GITHUB_REPOSITORY,,}/cso-scanners/" bun run scripts/cso-scanner-catalog.ts assemble qualified-fragments lib/cso/scanner-images/catalog.json catalog-proposal.json --revision "$revision" --source-commit "$GITHUB_SHA" --workflow "$workflow" --image-prefix "$image_prefix" bun run scripts/cso-scanner-catalog.ts validate catalog-proposal.json - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: cso-scanner-catalog-proposal path: catalog-proposal.json if-no-files-found: error retention-days: 30 promote-catalog: needs: catalog-proposal if: github.ref == 'refs/heads/main' && inputs.promote_catalog == true environment: cso-scanner-release runs-on: ubuntu-24.04 permissions: contents: write pull-requests: write actions: read packages: read steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: ref: main persist-credentials: true - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 with: bun-version: 1.4.0 - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: cso-scanner-catalog-proposal path: promotion - name: Recheck public visibility and anonymous pulls before promotion env: GH_TOKEN: ${{ github.token }} run: | set -euo pipefail mkdir public-image-evidence jq -c '.scanners[]' promotion/catalog-proposal.json | while IFS= read -r profile; do profile_id="$(printf '%s' "$profile" | jq -er '.id | select(test("^[a-z0-9][a-z0-9._-]{0,100}$"))')" image="$(printf '%s' "$profile" | jq -er '.image')" platform="$(printf '%s' "$profile" | jq -er '.platform | select(. == "linux/amd64" or . == "linux/arm64")')" bun run scripts/cso-public-ghcr.ts verify \ --image "$image" --platform "$platform" --repository "$GITHUB_REPOSITORY" \ --output "public-image-evidence/$profile_id.json" --remove-after done - name: Revalidate and open the reviewable source catalog PR env: GH_TOKEN: ${{ github.token }} run: | set -eu bun run scripts/cso-scanner-catalog.ts validate promotion/catalog-proposal.json bun run scripts/cso-scanner-catalog.ts validate-transition lib/cso/scanner-images/catalog.json promotion/catalog-proposal.json cp promotion/catalog-proposal.json lib/cso/scanner-images/catalog.json bun install --frozen-lockfile --ignore-scripts bun test test/cso-scanners.test.ts test/cso-scanner-executor.test.ts test/cso-scanner-release.test.ts bun run build:cso branch="cso-scanner-catalog-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT" git switch -c "$branch" git config user.name github-actions[bot] git config user.email 41898282+github-actions[bot]@users.noreply.github.com git add lib/cso/scanner-images/catalog.json git commit -m "Promote qualified CSO scanner catalog" git push --set-upstream origin "$branch" cat > pr-body.md <<'EOF' Promotes the complete scanner catalog produced by native amd64/arm64 qualification for all six CSO scanners. Each profile binds its immutable image, exact version-output hash, offline asset hash when required, containment and adapter gates, SBOM, provenance, source commit, and workflow run. Validation: scanner catalog contract tests and compiled CSO helper build. EOF gh pr create --base main --head "$branch" --title "Promote qualified CSO scanner catalog" --body-file pr-body.md