Artifact Management

Key concepts

name: Build artifacts
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
      - uses: docker/build-push-action@v5
        id: build
        with:
          push: true
          tags: ghcr.io/org/app:${{ github.sha }}
          outputs: type=image,name=ghcr.io/org/app,push=true

build-image:
  stage: build
  image: docker:24
  services: [docker:24-dind]
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  artifacts:
    reports:
      dotenv: build.env

Operational checklist

1. Pin deploy manifests to image@sha256:... not floating tags.
2. Generate SBOM on every main-branch build; upload to Dependency-Track or GUAC.
3. Sign images before promotion; verify in cluster before prod traffic.
4. Retention policy: keep prod digests 2+ years for forensic rebuild.
5. Replicate critical images to DR registry—supply chain continuity during outage.

flowchart LR
  SRC["Source commit"] --> CI["CI pipeline"]
  CI --> IMG["OCI image digest"]
  CI --> JAR["JAR / wheel"]
  CI --> CHART["Helm chart .tgz"]
  IMG --> REG["Registry"]
  REG --> GITOPS["GitOps digest pin"]

Key concepts

name: Push to registry
on: [push]
jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v5
        with:
          push: true
          tags: |
            ghcr.io/${{ github.repository }}:${{ github.sha }}
            ghcr.io/${{ github.repository }}:latest

publish:
  stage: publish
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

Operational checklist

1. Pin deploy manifests to image@sha256:... not floating tags.
2. Generate SBOM on every main-branch build; upload to Dependency-Track or GUAC.
3. Sign images before promotion; verify in cluster before prod traffic.
4. Retention policy: keep prod digests 2+ years for forensic rebuild.
5. Replicate critical images to DR registry—supply chain continuity during outage.

Registry hardening

• Enable vulnerability scanning on push (Harbor, ECR, GHCR native).
• Immutable tags for release channels—:latest is for local dev only.
• Geo-replication for DR; test failover pull quarterly.
• Audit log shipping to SIEM—who pushed digest sha256:abc?

Key concepts

name: Promote image
on:
  workflow_dispatch:
    inputs:
      digest:
        required: true
jobs:
  promote:
    runs-on: ubuntu-latest
    steps:
      - run: |
          crane copy ghcr.io/org/app@${{ inputs.digest }} ghcr.io/org/app:prod-approved
        env:
          CRANE_USERNAME: ${{ github.actor }}
          CRANE_PASSWORD: ${{ secrets.GITHUB_TOKEN }}

promote-prod:
  stage: deploy
  when: manual
  script:
    - crane copy $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA $CI_REGISTRY_IMAGE:prod
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

flowchart LR
  BUILD["CI build
single digest"] --> STG["Deploy staging
by digest"]
  STG --> TEST["Integration tests"]
  TEST --> PROMO["Promote digest
crane copy / retag"]
  PROMO --> PROD["Prod GitOps PR
updates digest only"]

Operational checklist

1. Pin deploy manifests to image@sha256:... not floating tags.
2. Generate SBOM on every main-branch build; upload to Dependency-Track or GUAC.
3. Sign images before promotion; verify in cluster before prod traffic.
4. Retention policy: keep prod digests 2+ years for forensic rebuild.
5. Replicate critical images to DR registry—supply chain continuity during outage.

Key concepts

name: SBOM
on: [push]
jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: anchore/sbom-action@v0
        with:
          artifact-name: sbom.spdx.json
          format: spdx-json
      - uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.spdx.json

sbom:
  stage: build
  image:
    name: anchore/syft:latest
    entrypoint: [""]
  script:
    - syft $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA -o spdx-json=sbom.spdx.json
  artifacts:
    paths: [sbom.spdx.json]

Operational checklist

1. Pin deploy manifests to image@sha256:... not floating tags.
2. Generate SBOM on every main-branch build; upload to Dependency-Track or GUAC.
3. Sign images before promotion; verify in cluster before prod traffic.
4. Retention policy: keep prod digests 2+ years for forensic rebuild.
5. Replicate critical images to DR registry—supply chain continuity during outage.

Key concepts

name: SLSA provenance
on: [push]
jobs:
  provenance:
    permissions:
      id-token: write
      contents: read
      attestations: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/attest-build-provenance@v1
        with:
          subject-name: ghcr.io/org/app
          subject-digest: sha256:abc123...
          push-to-registry: true

provenance:
  stage: attest
  image: slsa-framework/slsa-verifier:latest
  script:
    - echo "Generate provenance with GitLab runner OIDC + Sigstore"
  id_tokens:
    SIGSTORE_ID_TOKEN:
      aud: sigstore

flowchart TB
  L1["SLSA L1
Provenance"] --> L2["L2
Signed hosted build"]
  L2 --> L3["L3
Hardened hermetic"]
  L3 --> L4["L4
Two-person review"]

Operational checklist

1. Pin deploy manifests to image@sha256:... not floating tags.
2. Generate SBOM on every main-branch build; upload to Dependency-Track or GUAC.
3. Sign images before promotion; verify in cluster before prod traffic.
4. Retention policy: keep prod digests 2+ years for forensic rebuild.
5. Replicate critical images to DR registry—supply chain continuity during outage.

Key concepts

name: Sign image
on: [push]
jobs:
  sign:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      packages: write
    steps:
      - uses: sigstore/cosign-installer@v3
      - run: cosign sign --yes ghcr.io/org/app@${{ github.sha }}

sign-image:
  stage: sign
  image: gcr.io/projectsigstore/cosign:v2.2.0
  script:
    - cosign sign --yes $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  id_tokens:
    SIGSTORE_ID_TOKEN:
      aud: sigstore

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-signed-images
spec:
  validationFailureAction: Enforce
  rules:
    - name: verify-cosign
      match:
        any:
          - resources:
              kinds: [Pod]
      verifyImages:
        - imageReferences: ["ghcr.io/org/*"]
          attestors:
            - entries:
                - keyless:
                    subject: "https://github.com/org/repo/.github/workflows/sign.yml@refs/heads/main"
                    issuer: "https://token.actions.githubusercontent.com"
                    rekor:
                      url: https://rekor.sigstore.dev

Operational checklist

1. Pin deploy manifests to image@sha256:... not floating tags.
2. Generate SBOM on every main-branch build; upload to Dependency-Track or GUAC.
3. Sign images before promotion; verify in cluster before prod traffic.
4. Retention policy: keep prod digests 2+ years for forensic rebuild.
5. Replicate critical images to DR registry—supply chain continuity during outage.