[DeviaVir]

Summary

New optional inputs for publish.yml:

static-assets-path: /app/.next/static
static-assets-destination: gs://example-static-bucket/_next/static

When both are set, the publish job uploads that directory from the built image to GCS before it pushes the image. Use case: content-hashed web assets (for example Next.js .next/static with assetPrefix) stay available for every build. During a rolling deploy, a browser can no longer get HTML from one build and then a 404 for a chunk that only the other build's pods have.

Both inputs empty (the default): the step is skipped, with no behaviour change.

Design

• Trust model unchanged. The build job still runs caller code without cloud credentials. The new step runs in the publish job on the already digest-verified local OCI layout, and executes no caller content.
• Extraction. It selects linux/amd64 (or the single image), applies the layers in order, and honours OCI whiteouts and opaque directories.
  • Rejected: absolute paths, .., links and special files in the path or its ancestors, sparse entries, zstd layers, and oversized extension headers.
  • Limits: 50 MiB per file, 2 GiB total, 20,000 files.
• Upload. GCS JSON API multipart, create-only (ifGenerationMatch=0).
  • An existing object must match the content hash, the stored-byte md5 and the serving metadata. Otherwise the job fails, because content-hashed names must never change.
  • Text types are stored gzip-encoded, so GCS transcodes for clients without gzip. All objects get public, max-age=31536000, immutable.
  • 8 parallel uploads; retries on 429, 5xx and connection errors; a 600 s hard deadline.
• Safety. Inputs reach the scripts only as environment variables, and are validated in prepare. The token is never printed. TLS is verified; redirects and ambient proxies are refused. Errors do not echo transport or tar-controlled text.
• IAM (README): storage.objects.create, plus storage.objects.get for the existing-object comparison (a publicly readable bucket covers that).

Validation

• A harness that extracts the steps from publish.yml at run time: 62 tests pass on Python 3.12 and 3.13. It covers:
  • Raw and gzip layers, overwrites, whiteouts, opaque directories, traversal, links and special files, a missing or empty path, zstd refusal, and size limits (with reduced thresholds).
  • The real unpack step.
  • A fake GCS API: create, identical 412, different 412, 429/500/connection retries, refused redirects, content types, gzip correctness, object-name encoding.
• actionlint: clean. zizmor --offline: no findings.
• Not yet run on a real runner against a real bucket. The first consumer is a private repository that will verify it on its staging publish after release.

Release

After merge: release PR main → v1, tag v1.2.0.

Security review

Three independent read-only review rounds of this PR:

• Round 1: gate fail-open on dropped outputs, collision diagnostics, attacker text in errors, PAX sparse memory, gzip byte stability, queued uploads after a failure, timeout.
• Round 2: Solaris X and global PAX header limits, multi-platform assets, private tarfile hooks.
• Round 3: merge; the remaining optional items are also applied:
  • The 35-minute timeout applies only when static assets are used.
  • Content-Disposition and Content-Language are now compared.
  • Control characters are rejected in the path.
  • The README documents that the whole-image limits apply to every layer.

The harness now has 83 tests, all passing on Python 3.12 and 3.13. actionlint is clean, and zizmor --offline has no findings.

[Copilot]

🔵 Needs a closer look

Custom parsing of caller-controlled OCI layers and GCS upload handling in a credentialed job warrant human security review and real-runner/bucket validation beyond the local harness.

No open issues 🎉

What changed in this PR

Adds optional static-asset uploads to the reusable publish workflow so content-hashed assets remain available across rolling deployments. Uploads complete before image publishing, while callers that omit the new inputs retain existing behavior.

Changes:

• Adds paired asset-path and GCS-destination inputs, with validation and single-platform enforcement.
• Extracts assets from verified OCI layers and uploads them with create-only writes, collision checks, retries, and resource limits.
• Documents configuration, permissions, retention requirements, and a Next.js example.

File	Description
README.md	Documents static-asset setup, safety constraints, and usage.
.github/​workflows/​publish.yml	Adds input validation, bounded asset extraction, and GCS uploads before image publishing.

_{Review effort: Balanced}