[DeviaVir]

Summary

Security fixes after a review of #4 (released in v1.1.0) and of the repository. The diff against main contains only the fixes.

Note: v1 has the explicit-tag issue below now. A release of these fixes to v1 closes it.

Fixes to #4 (live in v1.1.0)

• Explicit tags could imitate derived tags. Any environment can pass tags, so a run in a non-production environment could publish prod-<hex>-<timestamp> (or <hex>-<timestamp>). Derived tags get prod- only in the production environment, and consumers can rely on that. Explicit tags that start with prod- (any case) or have the <hex>-<number> form are now rejected in prepare, before any build.
• Platform artifacts were downloaded by name. Any job in the caller's run can replace a named artifact (upload-artifact with overwrite: true) between build and publish. publish now downloads every artifact by ID, as the single-platform path already did. Each matrix leg sets its own job output, and publish checks that each ID is numeric.
• publish could sign a digest that the artifact does not contain. It took the digest from index.json and did not check that the manifest, config and layers are in the archive. If every explicit tag already pointed to that digest, nothing was pushed and the digest was still signed. Both paths now require every blob that the image references to be in the archive, with the declared size, before authentication.
• Ambiguous OCI JSON. crane decodes with Go, which matches keys case-insensitively. So a manifest could show layers to the checks and Layers to crane, or an index blob could pose as a manifest. Duplicate keys and keys that fold to a known field without an exact match are rejected, and the manifest blob must match its descriptor.
• A tag name could turn a registry error into "tag absent". The error parser read the whole crane error line, which contains the tag. A tag named MANIFEST_UNKNOWN made a 403 or 503 count as absent. The parser now removes the reference, the URL and quoted text first.
• Reads were not bounded. Manifest and config blobs are read only when the file on disk matches the declared size, up to 4 MiB. index.json and oci-layout are limited to 1 MiB.

Repository hardening

• build-environment must be a valid name and must differ from environment (case-insensitive), so caller code in build never gets the publish environment's secrets. No current caller sets it.
• publish holds the OIDC token. It no longer runs a third-party installer action: crane is downloaded with curl and checked against the same pinned release checksum.
• build pins the BuildKit image by version and digest instead of the moving default, because BuildKit produces the image that publish signs.
• lint.yml: actionlint 1.7.12 pinned by digest, with no network and a read-only mount. zizmor 1.31.1 (from 1.5.2), which now also audits dependabot.yml.
• Dependabot: 7-day cooldown, so a new action release ages before it reaches this workflow.
• README: documents the tag rule, and recommends --certificate-github-workflow-ref for consumers that must accept only one branch.

Validation

• actionlint 1.7.12: clean. zizmor 1.31.1 --min-severity low .github: no findings.
• The changed embedded scripts were extracted and run locally:
  • The tag rule rejects prod-abc-1, PROD-x, deadbeef-20261030101010 and 2026-10. It accepts v1.2.3, latest, 1.2, sha-abc, abc123 and a 40-character commit SHA.
  • The artifact ID checks reject a missing or non-numeric ID for each platform path.
  • The crane installer installs v0.22.1 with the pinned checksum and fails on a wrong checksum.
  • The unpack and merge step accepts a real BuildKit linux/amd64 archive on both paths. It rejects an archive without the manifest, the same real archive with one layer removed, a blob with a false declared size, and an oversized index.json.
  • Crafted layers/Layers, duplicate layers, an index blob posing as a manifest (two variants), ſize/Size and URLs keys are rejected on both paths; annotation keys that differ only by case are accepted.
  • The tag check reports "absent" for a real MANIFEST_UNKNOWN answer, also for tags named MANIFEST_UNKNOWN or NAME_UNKNOWN. It fails on 403, 503 and DENIED.
• CodeMender (gemini-4-argon, about 800k tokens) on the original publish.yml: explicit tags, native multi-arch builds, masked identity secrets #4 tree reported five HIGH findings. Four are the first four fixes above. The fifth (secrets in build) needs the caller to attack its own workflow; the build-environment guard covers the useful part of it.
• Known limit (unchanged, documented): the explicit-tag immutability check and the write are not atomic. Registry-side tag immutability is the real control.
• Live run 41053766093 from a temporary branch at 278947e (since deleted) called this publish.yml with a fake identity: one amd64+arm64 call and one single-platform call.
  • Both native builds ran. publish received each matrix job's artifact ID and downloaded each artifact by its ID.
  • The unpack and merge step accepted the real archives, with the platform checks.
  • crane installed with the checksum and cosign installed.
  • GitHub issued the OIDC token. The token exchange then failed as expected (invalid_target, because the provider does not exist).
• Not verified yet: a real token exchange, crane push (including --index to Artifact Registry) and cosign signing. These steps did not change in this PR, but the --index push from publish.yml: explicit tags, native multi-arch builds, masked identity secrets #4 has not run against Artifact Registry.

[Copilot]

🟡 Changes recommended

Manifest validation accepts structural-key collisions and mislabeled index blobs, allowing the workflow to skip pushing and sign digests with missing layers or child images.

2 open issues

• Validate blob media type before accepting image manifest fields · New
• Reject case-colliding OCI manifest keys before signing · New

What changed in this PR

This PR hardens the reusable image-publishing workflow’s build-to-publish boundary and artifact validation before signing.

Changes:

• Restricts explicit tags and build environments, and downloads platform artifacts by ID.
• Checks referenced OCI blobs and read sizes, strengthens registry-error parsing, and pins BuildKit and crane installation.
• Hardens lint execution, adds a Dependabot cooldown, and documents tag restrictions and branch verification.

File	Description
README.md	Documents tag restrictions, environment separation, and branch verification.
.github/​workflows/​publish.yml	Hardens artifact hand-off, OCI validation, input checks, and tool installation.
.github/​workflows/​lint.yml	Pins and isolates actionlint; upgrades zizmor and expands its scope.
.github/​dependabot.yml	Adds a seven-day cooldown for action updates.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The security-sensitive artifact hand-off lacks a live caller run validating matrix-output aggregation, artifact-ID downloads on both native architectures, and subsequent OIDC authentication and signing.

No open issues 🎉

2 resolved since last review

• Reject case-colliding OCI manifest keys before signing
• Validate blob media type before accepting image manifest fields

_{Review effort: Balanced}