container-attestation.yml

name: Container Attestation

"on":
  # No `paths:` filter on pull_request: build-smoke is a required
  # branch-protection check, so the job must COMPLETE on every PR.
  # A paths filter would leave docker-free PRs stuck forever on
  # "Expected - waiting for status". Path-gating happens inside the
  # job via the `changes` step instead.
  pull_request:
  workflow_dispatch:
    inputs:
      mode:
        description: Build a fresh GHCR image or sign an existing digest
        required: true
        default: build-and-sign
        type: choice
        options:
          - build-and-sign
          - sign-existing-digest
      image_ref:
        description: Container image repository/name without a digest
        required: false
        type: string
      image_digest:
        description: Immutable image digest, for example sha256:...
        required: false
        type: string
      confirm:
        description: Type SIGN to build/sign or sign an existing digest
        required: true
        type: string

# Top level stays read-only. Both operator-dispatched jobs receive only the
# package/OIDC writes needed for signing; attestation write is limited to the
# job that builds its own subject. The every-PR smoke job stays read-only.
permissions:
  contents: read

env:
  IMAGE_REF: ghcr.io/${{ github.repository_owner }}/agentflow-api

jobs:
  build-smoke:
    name: build-smoke
    # Runs on EVERY PR (required check). The `changes` step inspects the
    # diff against the PR base: when the Dockerfile / pip surface or this
    # workflow changed, the image is built without pushing or signing so a
    # broken Dockerfile fails the PR instead of landing silently; otherwise
    # the job completes immediately as a skip-success so the required check
    # never blocks docker-free PRs.
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - name: Detect container-relevant changes
        id: changes
        shell: bash
        run: |
          set -euo pipefail
          base="${{ github.event.pull_request.base.sha }}"
          changed="$(git diff --name-only "${base}...HEAD")"
          printf 'Changed files:\n%s\n' "${changed}"
          if printf '%s\n' "${changed}" | grep -E -q \
            '^(Dockerfile|pyproject\.toml$|requirements\.txt$|\.github/workflows/container-attestation\.yml$)'; then
            echo "docker=true" >> "$GITHUB_OUTPUT"
          else
            echo "docker=false" >> "$GITHUB_OUTPUT"
          fi
      - name: Skip note (no container-relevant changes)
        if: steps.changes.outputs.docker == 'false'
        run: echo "No Dockerfile*/pyproject.toml/requirements.txt/workflow changes - smoke build skipped, required check passes."
      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
        if: steps.changes.outputs.docker == 'true'
      - name: Build API image (no push)
        if: steps.changes.outputs.docker == 'true'
        id: smoke
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: Dockerfile.api
          push: false
          load: true
          tags: agentflow-api:pr-${{ github.event.pull_request.number }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  build-push-sign-attest:
    if: ${{ github.event_name == 'workflow_dispatch' && inputs.confirm == 'SIGN' && inputs.mode == 'build-and-sign' }}
    runs-on: ubuntu-latest
    timeout-minutes: 25
    # The production Environment must retain required-reviewer protection.
    environment: production
    permissions:
      contents: read
      packages: write
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Build and push API image
        id: build
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: .
          file: Dockerfile.api
          push: true
          tags: |
            ${{ env.IMAGE_REF }}:${{ github.sha }}
            ${{ env.IMAGE_REF }}:audit-${{ github.run_id }}

      - uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1

      - name: Sign pushed image digest with cosign keyless
        env:
          IMAGE_REF: ${{ env.IMAGE_REF }}
          IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
        run: cosign sign --yes ${IMAGE_REF}@${IMAGE_DIGEST}

      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-name: ${{ env.IMAGE_REF }}
          subject-digest: ${{ steps.build.outputs.digest }}
          push-to-registry: true

      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
        with:
          version: v3.16.3

      - name: Create immutable Helm promotion evidence
        env:
          IMAGE_REF: ${{ env.IMAGE_REF }}
          IMAGE_DIGEST: ${{ steps.build.outputs.digest }}
          SOURCE_SHA: ${{ github.sha }}
          BUILD_RUN_ID: ${{ github.run_id }}
        shell: bash
        run: |
          set -euo pipefail
          python scripts/write_image_promotion_evidence.py \
            --image-ref "$IMAGE_REF" \
            --image-digest "$IMAGE_DIGEST" \
            --source-sha "$SOURCE_SHA" \
            --run-id "$BUILD_RUN_ID" \
            --chart helm/agentflow \
            --output-dir .artifacts/image-promotion

      - name: Upload immutable Helm promotion evidence
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: agentflow-image-promotion-${{ github.sha }}
          path: .artifacts/image-promotion/
          if-no-files-found: error
          retention-days: 14

  attest-and-sign:
    if: ${{ github.event_name == 'workflow_dispatch' && inputs.confirm == 'SIGN' && inputs.mode == 'sign-existing-digest' }}
    runs-on: ubuntu-latest
    timeout-minutes: 10
    # The production Environment must retain required-reviewer protection.
    environment: production
    permissions:
      contents: read
      packages: write
      id-token: write
    env:
      IMAGE_REF: ${{ inputs.image_ref }}
      IMAGE_DIGEST: ${{ inputs.image_digest }}
      ALLOWED_IMAGE_REF: ghcr.io/${{ github.repository_owner }}/agentflow-api
    steps:
      - name: Validate digest inputs
        shell: bash
        run: |
          set -euo pipefail
          if [[ ! "$IMAGE_DIGEST" =~ ^sha256:[0-9a-f]{64}$ ]]; then
            echo "image_digest must match sha256 followed by 64 lowercase hex characters" >&2
            exit 1
          fi
          if [[ -z "$IMAGE_REF" ]]; then
            echo "image_ref is required for sign-existing-digest mode" >&2
            exit 1
          fi
          case "$IMAGE_REF" in
            *@*) echo "image_ref must not include a digest; provide image_digest separately" >&2; exit 1 ;;
            *:latest) echo "image_ref must not be a mutable :latest tag" >&2; exit 1 ;;
          esac
          if [[ "$IMAGE_REF" != "$ALLOWED_IMAGE_REF" ]]; then
            echo "image_ref must match the approved GHCR repository" >&2
            exit 1
          fi

      - uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1

      - name: Sign image digest with cosign keyless
        run: cosign sign --yes "${IMAGE_REF}@${IMAGE_DIGEST}"

      # This job signs an existing digest that it did not build, so it must not create build provenance.
      # Build provenance is emitted only by build-push-sign-attest for the image built in that same job.