Skip to content

ci: enable artifact signing (grant id-token/attestations to reusable-workflow callers) #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dcmcand merged 1 commit into from
Jul 30, 2026
Merged

ci: enable artifact signing (grant id-token/attestations to reusable-workflow callers) #144

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .github/workflows/build-images.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,18 @@ on:
- "model-downloader/**"
workflow_dispatch:

# Each job grants id-token + attestations so the reusable pack-build-image
# workflow can keyless-sign + attest (provenance + SBOM) the images it builds.
# These scopes are inert until the signing-enabled pack-build-image ships under
# @v1 (see nebari-dev/.github#46); PR builds still use push:false and are
# fork-safe (signing is skipped when nothing is pushed).
jobs:
operator:
permissions:
contents: read
packages: write
id-token: write
attestations: write
uses: nebari-dev/.github/.github/workflows/pack-build-image.yaml@v1
with:
image: operator
Expand All @@ -35,6 +45,11 @@ jobs:
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}

model-downloader:
permissions:
contents: read
packages: write
id-token: write
attestations: write
uses: nebari-dev/.github/.github/workflows/pack-build-image.yaml@v1
with:
image: model-downloader
Expand All @@ -45,6 +60,11 @@ jobs:
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}

key-manager:
permissions:
contents: read
packages: write
id-token: write
attestations: write
uses: nebari-dev/.github/.github/workflows/pack-build-image.yaml@v1
with:
image: key-manager
Expand All @@ -56,6 +76,11 @@ jobs:
QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}

frontend:
permissions:
contents: read
packages: write
id-token: write
attestations: write
uses: nebari-dev/.github/.github/workflows/pack-build-image.yaml@v1
with:
image: frontend
Expand Down
8 changes: 8 additions & 0 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,16 @@ on:
paths:
- "charts/nebari-llm-serving/Chart.yaml"

# The job grants id-token + attestations so the reusable pack-release workflow
# can keyless-sign the packaged chart and attach the signature bundle + SBOM to
# the GitHub Release. These scopes are inert until the signing-enabled
# pack-release ships under @v1 (see nebari-dev/.github#46).
jobs:
release:
permissions:
contents: write
id-token: write
attestations: write
uses: nebari-dev/.github/.github/workflows/pack-release.yaml@v1
with:
chart-path: charts/nebari-llm-serving
Expand Down