agentic-forges/forgejo-mcp
Watch
5
0
Fork
You've already forked forgejo-mcp
 0
Code Issues 8 Pull requests 7 Projects Releases 32 Packages 1 Activity

feat: enable Tekton Chains SLSA v1.0 provenance for release-tools image #165

Merged
goern merged 0 commits from refs/pull/165/head into main 2026-05-26 13:08:50 +00:00
Conversation 4 Commits - Files changed -
goern commented 2026-05-26 13:07:04 +00:00 (Migrated from codeberg.org)
Copy link

Summary

  • Add chains.tekton.dev/transparency-upload: "true" annotation to the release-tools publish PipelineRun so Tekton Chains uploads in-toto SLSA v1.0 provenance to Rekor
  • Propagate IMAGE_URL + IMAGE_DIGEST as pipeline-level results (required for Chains to bind image digest → PipelineRun → git commit → builder identity)
  • Add IMAGE_URL result to push-image-by-digest task (the plain registry URL, no tag/digest — what Chains expects)
  • Document cosign verify-attestation --type slsaprovenance verification in README
  • Update ADR with Chains addendum; remove "Publishing Tekton Chains attestations" from out-of-scope

Motivation

A cosign signature alone attests signer-holds-key. SLSA provenance additionally binds image digest → PipelineRun → git commit → builder identity. This closes the L5 provenance gap identified in the adversarial review of the release-tools image (forgejo-mcp-46j).

Without pipeline-level IMAGE_URL/IMAGE_DIGEST results, Chains generates subject-less provenance that cannot be tied to a specific image — the results wiring is what makes the attestation useful.

Test plan

  • Tag a release-tools/vX.Y.Z ref and confirm PipelineRun succeeds
  • After Chains signs the PipelineRun, verify attestation exists: 
    cosign verify-attestation --type slsaprovenance \
  --key cosign-images.pub \
  codeberg.org/operate-first/release-tools:vX.Y.Z | jq .
  • Confirm provenance payload references the correct git revision and PipelineRun name
  • Confirm Rekor entry created (check rekor-cli search --artifact ... or the Chains transparency log annotation on the PipelineRun)

Closes #forgejo-mcp-46j

## Summary - Add `chains.tekton.dev/transparency-upload: "true"` annotation to the release-tools publish PipelineRun so Tekton Chains uploads in-toto SLSA v1.0 provenance to Rekor - Propagate `IMAGE_URL` + `IMAGE_DIGEST` as pipeline-level results (required for Chains to bind image digest → PipelineRun → git commit → builder identity) - Add `IMAGE_URL` result to `push-image-by-digest` task (the plain registry URL, no tag/digest — what Chains expects) - Document `cosign verify-attestation --type slsaprovenance` verification in README - Update ADR with Chains addendum; remove "Publishing Tekton Chains attestations" from out-of-scope ## Motivation A cosign signature alone attests *signer-holds-key*. SLSA provenance additionally binds image digest → PipelineRun → git commit → builder identity. This closes the L5 provenance gap identified in the adversarial review of the release-tools image (forgejo-mcp-46j). Without pipeline-level `IMAGE_URL`/`IMAGE_DIGEST` results, Chains generates subject-less provenance that cannot be tied to a specific image — the results wiring is what makes the attestation useful. ## Test plan - [ ] Tag a `release-tools/vX.Y.Z` ref and confirm PipelineRun succeeds - [ ] After Chains signs the PipelineRun, verify attestation exists: ```bash cosign verify-attestation --type slsaprovenance \ --key cosign-images.pub \ codeberg.org/operate-first/release-tools:vX.Y.Z | jq . ``` - [ ] Confirm provenance payload references the correct git revision and PipelineRun name - [ ] Confirm Rekor entry created (check `rekor-cli search --artifact ...` or the Chains transparency log annotation on the PipelineRun) Closes #forgejo-mcp-46j
op1st-gitops commented 2026-05-26 13:07:08 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/on-pull-request-tx7jl is running.

Starting Pipelinerun on-pull-request-tx7jl in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-tx7jl -f

op1st Pipelines as Code/on-pull-request-tx7jl is running. Starting Pipelinerun <b>[on-pull-request-tx7jl](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tx7jl)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tx7jl) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-tx7jl -f</code>
op1st-gitops commented 2026-05-26 13:07:08 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/code-scans-cptqd is running.

Starting Pipelinerun code-scans-cptqd in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-cptqd -f

op1st Pipelines as Code/code-scans-cptqd is running. Starting Pipelinerun <b>[code-scans-cptqd](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-cptqd)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-cptqd) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-cptqd -f</code>
op1st-gitops commented 2026-05-26 13:07:28 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/code-scans-cptqd has successfully validated your commit.

Task Statuses:

StatusDurationName
Succeeded 12 seconds

fetch-source

Succeeded 7 seconds

gitleaks-version

Succeeded 6 seconds

gitleaks

op1st Pipelines as Code/code-scans-cptqd has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-cptqd">code-scans-cptqd</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>12 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-cptqd/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>7 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-cptqd/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>6 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-cptqd/logs/gitleaks) </td></tr> </table>
op1st-gitops commented 2026-05-26 13:08:29 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/on-pull-request-tx7jl has successfully validated your commit.

Task Statuses:

StatusDurationName
Succeeded 10 seconds

fetch-source

Succeeded 1 minute

build-and-test

op1st Pipelines as Code/on-pull-request-tx7jl has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tx7jl">on-pull-request-tx7jl</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tx7jl/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tx7jl/logs/build-and-test) </td></tr> </table>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
Compat/Breaking
Breaking change that won't be backward compatible

  
Kind/Bug
Something is not working

  
Kind/Documentation
Documentation changes

  
Kind/Enhancement
Improve existing functionality

  
Kind/Feature
New functionality

  
Kind/OpenSpec
OpenSpec change proposal / spec-driven work

  
Kind/Security
This is security issue

  
Kind/Testing
Issue or pull request related to testing

  
Priority/Critical
The priority is critical

  
Priority/High
The priority is high

  
Priority/Low
The priority is low

  
Priority/Medium
The priority is medium

  
RFC - Request For Comments
Request For Comments — design/spec open for feedback before implementation

  
Reviewed/Confirmed
Issue has been confirmed

  
Reviewed/Duplicate
This issue or pull request already exists

  
Reviewed/Invalid
Invalid issue

  
Reviewed/Won't Fix
This issue won't be fixed

  
Status/Abandoned
Somebody has started to work on this but abandoned work

  
Status/Blocked
Something is blocking this issue or pull request

  
Status/Need More Info
Feedback is required to reproduce issue or to continue work

  
hermes-attempted
Hermes attempted but produced no changes

  
hermes-needs-clarification
Quality gate flagged, needs human input

  
hermes-ready
Ready for hermes to process

  
hermes-review
Hermes PR awaiting review

  
hermes-wip
Hermes is working on this

  
human-required
Hermes gave up after 3 attempts

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/OpenSpec
Kind/Security
Kind/Testing
Priority/Critical
Priority/High
Priority/Low
Priority/Medium
RFC - Request For Comments
Reviewed/Confirmed
Reviewed/Duplicate
Reviewed/Invalid
Reviewed/Won't Fix
Status/Abandoned
Status/Blocked
Status/Need More Info
hermes-attempted
hermes-needs-clarification
hermes-ready
hermes-review
hermes-wip
human-required
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
agentic-forges/forgejo-mcp!165
No description provided.