Repository navigation
ci: stop the PR image builds from printing the GitHub event payload (PER-17677) - #420
Merged
Merged
Conversation
…PER-17677) On a public repo docker/build-push-action defaults to max-mode provenance, and prints it in each step's "Metadata" log group. Its invocation block holds the whole event payload, which on a pull_request run is the PR title and description as they were when the run started. The three tests.yml builds only fill the cache or load the image locally, so turn provenance off there. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
✅ Cargo Security AuditNo vulnerable crates in 1 warning(s): unmaintained or yanked crates
|
PDP image vulnerability reportImage: ✅ No CRITICAL or HIGH findings after waivers. TrivyNo CRITICAL or HIGH findings. Docker ScoutNo CRITICAL or HIGH findings. Scanned by Trivy, Docker Scout. Waivers: |
…uilds (PER-17677) provenance: false only drops the attestation. buildx still writes min-mode provenance into the metadata file, and the action prints that file; its invocation environment holds the whole GitHub event payload. The first run on this PR still printed it 6 times. BUILDX_METADATA_PROVENANCE=disabled turns it off. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
1 of 2 tasks
zeevmoney
approved these changes
Oct 22, 2026
zeevmoney
left a comment
zeevmoney
left a comment
Member
There was a problem hiding this comment.
Approved — no CRITICAL or HIGH issues found.
Non-blocking:
- LOW
.github/workflows/tests.yml:132— two claims in theprovenance: falsecomment don't fit every step
Details are in the inline comments on each line.
The action adds its default attestation only to the cache-only builds, not to the load: true one, and the arm64 opa_build step only compiles a stage. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
docker-scout now reports CVE-2026-114145 (high) on gitpython 3.2.0, fixed in 3.2.1, so the image gate fails on every new PDP build, this PR's included. Floor the transitive dependency at 3.2.1 and move only gitpython in the lock (uv 0.12.19, the image's version, so revision stays 3). Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear: PER-17677
Why
In each step's
Metadatalog group,docker/build-push-actionprints the build's metadata file. That includesbuildx.build.provenance, and itsinvocation.environmentholdsgithub_event_payload, the whole GitHub event. On apull_requestrun that's the PR's title and description as they were when the run started. So everybuild-pdp-imagejob copies the PR description into the run's public log, and editing the description later doesn't remove it from there.The payload comes from two places:
minmode by default, andminalready includes the event payload.BUILDX_METADATA_PROVENANCEcontrols this.--attest type=provenance,mode=max, which embeds the same payload. Theprovenanceinput controls this.What
BUILDX_METADATA_PROVENANCE: disabledin thebuild-pdp-imagejob envMetadatagroup, from carrying provenance. On its own, the first commit (provenance: false) left 6github_event_payloadoccurrences in this PR's first run.provenance: falseon the threebuild-push-actionsteps: therust_chefcache step, the arm64opa_buildstep, and the build that loadspermitio/pdp-v2:nextOne more commit, because it was turning this PR's CI red:
GitPythonfloor 3.1.59 → 3.2.1 inpyproject.toml; lock moves onlygitpython3.2.0 → 3.2.1 (uv 0.12.19, sorevisionstays 3)docker-scoutnow reports CVE-2026-114145 (high) on gitpython 3.2.0, fixed in 3.2.1, so the image gate fails on every new PDP build. Nothing here imports GitPython; it comes in through opal-common.release.ymlis unchanged. Whether published images should carry provenance, and in which mode, is part of signing and provenance for releases (PER-16901).Verification
pre-commit(the repo's hooks) andzizmor --offlineontests.ymlpass.provenance: falseonly): the builds ran with--attest type=provenance,disabled=true, but the log still hadgithub_event_payload6 times, from the metadata file.ec9cbad, run 39832596994):build-pdp-imagepassed, and its log has 0github_event_payloadand 0buildx.build.provenance. The threeMetadatagroups are still printed, without provenance.🤖 Generated with Claude Code