fix(image-builder): silence platform lint + sign container images#3186
Merged
Conversation
- Drop the literal --platform on the Qt 5 sysroot stage; a bare FROM already defaults to the armhf target platform for pi2/pi3. - Route the Qt 5 host stage's mandatory amd64 pin through a global QT5_HOST_PLATFORM ARG declared in Dockerfile.viewer.j2, so it stays in scope for the FROM --platform in the included builder template. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Resolve each pushed <short-hash>-<board> image digest and mint keyless Sigstore build-provenance attestations via GitHub OIDC (same mechanism the SBOM workflow uses). - Attest server/viewer/redis on GHCR (hard-fail) and Docker Hub (best-effort, matching publish-latest's soft-fail mirror). - Grant the buildx job id-token: write + attestations: write. Attestations are by digest, so latest-<board> tags and both registries are covered; verify with `gh attestation verify oci://...`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Updates the container image build pipeline to (1) address BuildKit lint warnings in the Qt 5 viewer build templates and (2) add keyless Sigstore build-provenance attestations for pushed images as part of the CI build.
Changes:
- Introduces a global
QT5_HOST_PLATFORMARG (scoped before the firstFROM) to avoid literal--platformpins while keeping the Qt 5 host stage forced to amd64. - Removes the literal
--platform=linux/arm/v7from the Qt 5 sysroot stage to silenceFromPlatformFlagConstDisallowed. - Extends the
docker-buildworkflow to resolve pushed image digests and mint/push build-provenance attestations for server/viewer/redis images (GHCR hard-fail; Docker Hub best-effort).
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
docker/Dockerfile.viewer.j2 |
Adds a pre-FROM global ARG to support Qt 5 host-stage platform pinning without triggering BuildKit lint. |
docker/Dockerfile.qt5-webview-builder.j2 |
Removes constant --platform usage in the sysroot stage and routes the amd64 host pin through the new global ARG. |
.github/workflows/docker-build.yaml |
Adds OIDC/attestation permissions and per-board digest resolution + provenance attestation steps for pushed images. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The header's stage layout described webview-builder as running on $BUILDPLATFORM and installing Linaro's gcc-7.4.1 cross-compiler. Both are stale: the stage is pinned to linux/amd64 via QT5_HOST_PLATFORM (and the stage's own comment now explicitly warns that $BUILDPLATFORM would break it on an Apple Silicon host), and Linaro's tarball was dropped for Debian's crossbuild-essential-armhf when releases.linaro.org retired — the Linaro-named path survives only as a symlink shim for the frozen qmake.conf. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issues Fixed
No associated issue. Fixes the two
FromPlatformFlagConstDisallowedBuildKit lint warnings surfaced in the Docker Image Build CI job, and adds container image signing.Description
Two independent supply-chain / build-hygiene changes:
FromPlatformFlagConstDisallowedin the Qt 5 webview builder template. The sysroot stage drops its literal--platform(a bareFROMalready defaults to the armhf target for pi2/pi3), and the host toolchain stage's mandatorylinux/amd64pin is routed through a globalQT5_HOST_PLATFORMARG declared inDockerfile.viewer.j2(so it stays in scope for the included stage'sFROM --platform). Verified withdocker build --checkon a rendered pi2 Dockerfile: warnings gone, no ARG-scoping errors.buildxjob now resolves each pushed<short-hash>-<board>image digest and mints keyless Sigstore build-provenance attestations via GitHub OIDC — the same mechanism the SBOM workflow already uses.server/viewer/redisare attested on GHCR (hard-fail) and Docker Hub (best-effort, matching howpublish-latesttreats its Docker Hub mirror). Attestation is by digest, so thelatest-<board>tags and both registries are covered; verify withgh attestation verify oci://... --repo Screenly/Anthias.Checklist
Note
The attestation steps only run on
masterpushes (gated ongithub.event_name == 'push', like the existing image push), so they cannot be exercised from this PR branch — they take effect on the first post-merge build.