feat(flatcar): add containerd auto-update workflow, improve pipeline observability and SBOM management#482
Open
mgrzybek wants to merge 4 commits into
Open
feat(flatcar): add containerd auto-update workflow, improve pipeline observability and SBOM management#482mgrzybek wants to merge 4 commits into
mgrzybek wants to merge 4 commits into
Conversation
Signed-off-by: Mathieu Grzybek <mathieu@stackhpc.com>
Signed-off-by: Mathieu Grzybek <mathieu@stackhpc.com>
Signed-off-by: Mathieu Grzybek <mathieu@stackhpc.com>
Flatcar publishes a signed SBOM for every release (flatcar_production_image_sbom.json). Download and reuse it instead of mounting the image and running anchore/sbom-action, which drops the libguestfs mount/unmount steps entirely and scans/publishes the official SBOM as-is. Signed-off-by: Mathieu Grzybek <mathieu@stackhpc.com>
mgrzybek
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
flatcar/sysext-bakerynightly (01:00 UTC), compares withcontainerd_versioninvars/flatcar/versions.json, and opens a PR when a newer version is found. The actual sysext upload to S3 is handled by the existing Flatcar sysexts workflow on the next run after merge.flatcar-update.yml— each version detection step now logs its result explicitly, and a new Compare versions step summarises both values and the build decision before build_image is evaluated.flatcar_versioninvars/flatcar/versions.json— clears the placeholder version so the next flatcar-update run detects a real version change and triggers build_image for the first time (theflatcar_image_urlfield was previously empty).build_imagenow reuses Flatcar's own official SBOM instead of regenerating one (Flatcar publishes a signedflatcar_production_image_sbom.jsonfor every stable release).flatcar-download-imagefetches it alongside the image,anchore/scan-actionscans it directly, andflatcar-publish-imageuploads it to S3 unchanged. This removes theguestmount/guestunmountsteps, thelibguestfs-toolsdependency and theanchore/sbom-actionstep from the job.How the containerd update flow works
flatcar-containerd-update└─ detect latest containerd-* tag in sysext-bakery
└─ if version changed, then PR updating versions.json
PR merged└─ flatcar-sysexts
└─ downloads containerd--x86-64.raw from sysext-bakery
└─ uploads to S3
└─ updates sysext-manifest.json → PR
How the official SBOM is used
build_image└─ flatcar-download-image
└─ downloads flatcar_production_openstack_image.img.bz2
└─ downloads flatcar_production_image_sbom.json (official, signed by Flatcar)
└─ anchore/scan-action scans the official SBOM for critical vulnerabilities
└─ flatcar-publish-image uploads the image + the official SBOM (as-is) + cosign bundle to S3