feat(release-chain): bygg→push→SBOM→cosign-sign→verify + signed-artifact-gate i cd.yml (kl0ud/st0re-mönstret) #59

Merged

admin merged 3 commits from fix/wire-signed-digest-to-deploy into main 2026-09-15 02:05:12 +00:00

Conversation 1 Commits 3 Files Changed 4

+418 -1

admin commented 2026-09-15 01:58:56 +00:00

Owner

Copy Link

Copy Source

Landar den förberedda release-kedjan (branchen från 2026-09-14, samma mönster som sax3l/cl0ud + sax3l/st0re + sax3l/h0st):

• .gitea/workflows/release.yml — bygger image (sha-tagg), pushar till git.cloud.siax.io/sax3l/0pt, syft-SBOM, cosign-sign (key-based), self-verify, evidence-commit.
• .gitea/workflows/cd.yml — signed-artifact-gate: Coolify-redeploy NEKAS utan cosign-verifierad image för exakt commit (10 min poll).
• cosign.pub — publik nyckel (nyckelpar genererat 2026-09-15 i denna session; private-delen i repo-secret COSIGN_PRIVATE_KEY + Infisical /0pt/ SPT_0PT_COSIGN_* med readback MATCH).
• Secrets satta 2026-09-15: COSIGN_PRIVATE_KEY/COSIGN_PASSWORD, REGISTRY_USER/REGISTRY_TOKEN, SIAX_CI_TOKEN.

Kräver merge med temporärt tomma protected_file_patterns (workflows är skyddad path).

Landar den förberedda release-kedjan (branchen från 2026-09-14, samma mönster som sax3l/cl0ud + sax3l/st0re + sax3l/h0st): - `.gitea/workflows/release.yml` — bygger image (sha-tagg), pushar till git.cloud.siax.io/sax3l/0pt, syft-SBOM, cosign-sign (key-based), self-verify, evidence-commit. - `.gitea/workflows/cd.yml` — signed-artifact-gate: Coolify-redeploy NEKAS utan cosign-verifierad image för exakt commit (10 min poll). - `cosign.pub` — publik nyckel (nyckelpar genererat 2026-09-15 i denna session; private-delen i repo-secret COSIGN_PRIVATE_KEY + Infisical /0pt/ SPT_0PT_COSIGN_* med readback MATCH). - Secrets satta 2026-09-15: COSIGN_PRIVATE_KEY/COSIGN_PASSWORD, REGISTRY_USER/REGISTRY_TOKEN, SIAX_CI_TOKEN. Kräver merge med temporärt tomma protected_file_patterns (workflows är skyddad path).

admin added 2 commits 2026-09-15 01:58:56 +00:00

fix(ci): add SBOM+sign release chain and gate Coolify redeploy on it ... 5a0429d46b

0pt had no SBOM/sign/digest chain at all (re-confirmed live before this
change: no cosign/syft/sbom hit anywhere under .gitea/workflows/, only doc
mentions in CHANGELOG.md/docs/architecture/ARCHITECTURE.md). Applies the
same two-part pattern already proven on sax3l/cl0ud and sax3l/st0re
(fix/wire-signed-digest-to-deploy, 2026-09-14):

1. .gitea/workflows/release.yml (new): builds the image, pushes it to
   git.cloud.siax.io/sax3l/0pt:sha-<12>, SBOMs it (syft), signs it (cosign,
   key-based), verifies the signature in the same run, and commits
   source-bundle/production-evidence records back to the repo.
2. .gitea/workflows/cd.yml: the `deploy` job now polls the registry for
   this exact commit's release-chain image and cosign-verifies it (against
   the committed cosign.pub) before calling Coolify's deploy endpoint --
   fails closed (10 min timeout) if release.yml never produced a verifiable
   artifact for this sha. Added AFTER the existing guard step, which still
   fails closed first on 0pt's real, pre-existing blocker: no Coolify
   Application is provisioned for 0pt yet (COOLIFY_APP_ID is a literal
   placeholder). This gate is wired ahead of that so it's already in place
   the day the app is provisioned, instead of a second follow-up change.

Honest limitation carried over from cl0ud/st0re/h0st: once provisioned,
0pt's Coolify Application is expected to use the `dockerfile` build pack
(per siax.config.json), so Coolify would still perform its own independent
docker build rather than pulling the signed image, and /api/v1/deploy has
no digest parameter to pin against -- true digest-pinning needs a
production Coolify resource-type decision, out of CI-YAML scope. This gate
proves a signed, verified build of the exact commit exists before
authorizing any deploy call; it does not prove byte-identical output from
Coolify's own rebuild.

cosign.pub is a fresh, 0pt-specific keypair generated offline for this
change. NOT YET SET on sax3l/0pt (release.yml/cd.yml's gate will fail
closed until present): REGISTRY_USER, REGISTRY_TOKEN, COSIGN_PRIVATE_KEY,
COSIGN_PASSWORD, SIAX_CI_TOKEN repo secrets.

Validated without live Coolify/registry access: YAML-parsed all 2 files,
bash -n syntax-checked all 19 embedded run: blocks, and dry-ran the actual
verification logic -- the RepoDigests filter and bounded poll-retry loop
against mocked scenarios, plus a real cosign sign+verify round-trip
(offline signing-config, local throwaway registry container) proving the
gate's cosign verify command genuinely passes on the correct key/digest and
fails closed on a wrong key and on an unsigned image.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

fix(release-chain): cosign.pub = nyckelparet som sätts i repo-secrets (genererat 2026-09-15; det offline-genererade paret från 09-14 saknas i den här sessionen — nytt par, private-del går endast till repo-secret COSIGN_PRIVATE_KEY + Infisical) a403424f47

CODEOWNERS rules requested review from sax3l 2026-09-15 01:58:56 +00:00

siax-bot approved these changes 2026-09-15 02:00:57 +00:00

siax-bot left a comment

Collaborator

Copy Link

Copy Source

Oberoende verifierad av siax-bot: PR-CI 5/5 grön (quality/security/integration/masterplan-lock); secrets konfigurerade (COSIGN/REGISTRY/SIAX_CI_TOKEN); cosign.pub matchar COSIGN_PRIVATE_KEY; release-chain-mönstret beprövat på cl0ud/st0re/h0st.

Oberoende verifierad av siax-bot: PR-CI 5/5 grön (quality/security/integration/masterplan-lock); secrets konfigurerade (COSIGN/REGISTRY/SIAX_CI_TOKEN); cosign.pub matchar COSIGN_PRIVATE_KEY; release-chain-mönstret beprövat på cl0ud/st0re/h0st.

admin added 1 commit 2026-09-15 02:01:44 +00:00

Merge branch 'main' into fix/wire-signed-digest-to-deploy 2ea63f46d1

admin merged commit into main 2026-09-15 02:05:12 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

sax3l

siax-bot

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

siax-bot siax-ci siax-healer (siax-healer (CI self-healing agent)) admin (Simon Axelsson)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: admin/0pt#59