devops/apps-registry
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(devsecops): firmar y verificar imagenes por digest, no por tag
Build and Push Medusa / Escaneo de Secretos (Gitleaks) (push) Successful in 58s
Details
Build and Push Frontend / Escaneo de Secretos (Gitleaks) (push) Successful in 32s
Details
Build and Push Docs Portal / Escaneo de Secretos (Gitleaks) (push) Successful in 35s
Details
Build and Push Medusa / Construir y publicar Medusa (push) Successful in 18m58s
Details
Build and Push Frontend / Construir y Subir Imagen (push) Successful in 12m0s
Details
Build and Push Docs Portal / Construir y publicar Docs Portal (push) Successful in 5m43s
Details

Browse Source 
Los 3 pipelines (frontend, commerce-backend, docs-portal) ahora capturan
el digest real del docker push y lo usan como referencia para cosign
sign/verify, en vez del tag mutable :VERSION. Documenta ademas la
decision de mantener Rekor deshabilitado (registry privado, evita
dependencia de red saliente hacia rekor.sigstore.dev via el tunel).

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_011FqYP3Wf1W63Qmh7qgXAAT
This commit is contained in:
devops
2026-08-16 14:46:01 -05:00
co-authored by Claude Sonnet 5
parent b3da3cc131
commit ac095ff981
4 changed files with 94 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy-docs.yaml
+14 -4
View File
@@ -282,12 +282,21 @@ jobs:
# Login ya se hizo arriba; recién acá se sube, después de que la
# imagen pasó el gate de CRITICAL.
- name: Subir Imagen al Registry
id: push
shell: bash
run: |
set -euo pipefail
docker push "${IMAGE_NAME}:${{ steps.vars.outputs.VERSION }}"
PUSH_OUTPUT="$(docker push "${IMAGE_NAME}:${{ steps.vars.outputs.VERSION }}")"
echo "${PUSH_OUTPUT}"
docker push "${IMAGE_NAME}:latest"
DIGEST="$(echo "${PUSH_OUTPUT}" | grep -oE 'sha256:[a-f0-9]{64}' | tail -1)"
test -n "${DIGEST}" || {
echo "ERROR: no se pudo extraer el digest del push."
exit 1
}
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
- name: Instalar Cosign
shell: bash
run: |
@@ -301,7 +310,8 @@ jobs:
# Mismo par de llaves que el frontend y commerce-backend (secrets
# ya existentes a nivel de repo). Llave pública commiteada en
# workloads/docs-portal/cosign.pub.
# workloads/docs-portal/cosign.pub. Firma por digest (no por tag),
# mismo criterio que build.yaml.
- name: Firmar Imagen (Cosign)
shell: bash
env:
@@ -314,7 +324,7 @@ jobs:
--use-signing-config=false \
--tlog-upload=false \
--yes \
"${IMAGE_NAME}:${{ steps.vars.outputs.VERSION }}"
"${IMAGE_NAME}@${{ steps.push.outputs.digest }}"
- name: Verificar Firma (smoke test)
shell: bash
@@ -323,7 +333,7 @@ jobs:
/tmp/cosign verify \
--key "${APP_DIR}/cosign.pub" \
--insecure-ignore-tlog=true \
"${IMAGE_NAME}:${{ steps.vars.outputs.VERSION }}"
"${IMAGE_NAME}@${{ steps.push.outputs.digest }}"
- name: Verificar promoción segura
id: promotion