From e71a674523f6b2f53949fb5539d2065a76da1a55 Mon Sep 17 00:00:00 2001 From: dvcdsys Date: Sat, 2 May 2026 11:43:32 +0100 Subject: [PATCH] ci(release-server): enable max provenance + SBOM on Docker images Adds `provenance: mode=max` and `sbom: true` to both build-push steps (CPU and CUDA) in release-server.yml. Docker Scout grade dropped from B (locally pushed images via `make scout-cuda` / `make docker-build-cuda-dev`) to C (CI-pushed `:cu128` / `:latest`) because the local Makefile targets pass these flags explicitly while `docker/build-push-action@v6` defaults to `provenance: mode=min` and `sbom: false`. Without an SBOM the "Supply chain attestations" policy fails, dragging the grade down. Aligning the CI flags with the Makefile should restore grade B on the next `server/v*` release without changing image contents. Co-Authored-By: Claude Opus 4.7 --- .github/workflows/release-server.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release-server.yml b/.github/workflows/release-server.yml index 6df9827a..6922ab62 100644 --- a/.github/workflows/release-server.yml +++ b/.github/workflows/release-server.yml @@ -39,6 +39,8 @@ jobs: file: server/Dockerfile platforms: linux/amd64,linux/arm64 push: true + provenance: mode=max + sbom: true build-args: VERSION=${{ steps.ver.outputs.version }} tags: | dvcdsys/code-index:${{ steps.ver.outputs.version }} @@ -71,6 +73,8 @@ jobs: file: server/Dockerfile.cuda platforms: linux/amd64 push: true + provenance: mode=max + sbom: true build-args: VERSION=${{ steps.ver.outputs.version }} tags: | dvcdsys/code-index:${{ steps.ver.outputs.version }}-cu128