Release: check the release safety steps and add build attestations
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 55/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- github-actions
- Domain
- release
Research direction
Start by reading docs/RELEASE.md and the release workflows to compare their environment approvals and digest-based promotion and rollback with the stated plan. Document what the workflows currently do, then add an image build attestation and verify it with gh attestation verify; ensure the signing job has only the required permissions and explain each in the pull request.
Written by the indexing model from the issue text.
Description
What needs doing
The plan for a release asks for three things: environments with an
approval, images promoted and rolled back by digest, and a signed
statement of where each image was built (a build attestation).
Compare the release workflows with that list, write down what is
there, and add the attestation step for the images.
Why
A user who pulls an image should be able to check that it was built
by this repository's release workflow from the tagged commit.
Done when
-
docs/RELEASE.mdsays, for each of the three, what the
workflows do today. - A released image carries an attestation that
gh attestation verifyaccepts. - The job that signs has only the permissions it needs, and the
pull request says why each is needed.
- Dominant language
- Python
- Stars
- 2.1k
- Forks
- 197
- Avg merge
- 7h 5m
- Merged PRs (30d)
- 425
Getting set up
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from inferstep/ATLAS
-
Bootstrap: the last two steps run as the user who owns the installMay be free again @assassinationss claimed this 25 days ago, and no pull request is open. Openarea/install reliability
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
inferstep/ATLAS#412 · 4 comments ·
Maintainers usually reply within 1 day
-
area/cli
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Maintainers usually reply within 1 day
-
area/cli area/lens status/ready
Difficulty 2/5 Half a day Newbie friendliness 66/100
Maintainers usually reply within 1 day
-
area/ci status/ready
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
inferstep/ATLAS#245 · 4 comments ·
Maintainers usually reply within 1 day
-
area/ci needs-triage security
Difficulty 4/5 3-5 days Newbie friendliness 15/100
inferstep/ATLAS#731 · 1 comment ·
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
microsoft/markitdown#2820 ·
Maintainers usually reply within 1 day
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
yt-project/yt#5624 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
NousResearch/hermes-agent#148376 ·
Maintainers usually reply within 1 day