feat: add Chainloop CLI to runner image

Needed for Velmios release-path attestation craft against the red control plane.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: miragecentury

AGENTS.md

@@ -8,7 +8,7 @@ Self-hosted GitHub Actions runner **container image** for Deerhide / Velmios CI:
 
 - Image: `ghcr.io/deerhide/python-github-runner`
 - Base: `ghcr.io/actions/actions-runner` (`RUNNER_VERSION` in `manifest.yaml`)
-- Includes Python 3.12/3.13 (deadsnakes), Poetry, UV, DevOps CLIs (argo, kargo, kubectl, pack, crane, skopeo, buildah, …), OpenAPI CLIs (redocly, spectral, portman, newman, oasdiff), Node/Bun, Rust + Zig + cargo-lambda (AWS Lambda Rust CI), and a full OCI build/scan pipeline so the image can build itself.
+- Includes Python 3.12/3.13 (deadsnakes), Poetry, UV, DevOps CLIs (argo, kargo, chainloop, kubectl, pack, crane, skopeo, buildah, …), OpenAPI CLIs (redocly, spectral, portman, newman, oasdiff), Node/Bun, Rust + Zig + cargo-lambda (AWS Lambda Rust CI), and a full OCI build/scan pipeline so the image can build itself.
 
 Tool inventory and version tables live in [README.md](README.md). Do not duplicate them here.
 

Containerfile

@@ -108,6 +108,13 @@ RUN curl -sSL -o /usr/local/bin/kargo \
       "https://github.com/akuity/kargo/releases/download/v${KARGO_VERSION}/kargo-linux-amd64" \
     && chmod +x /usr/local/bin/kargo
 
+# Install Chainloop CLI (supply-chain attestation craft against red control plane)
+ARG CHAINLOOP_VERSION=1.105.4
+RUN curl -sSL -o /usr/local/bin/chainloop \
+      "https://github.com/chainloop-dev/chainloop/releases/download/v${CHAINLOOP_VERSION}/chainloop-linux-amd64" \
+    && chmod +x /usr/local/bin/chainloop \
+    && chainloop version
+
 # Install kubectl (in-cluster kpack Build CRs from green ARC runners)
 ARG KUBECTL_VERSION=1.36.3
 RUN curl -sSL -o /usr/local/bin/kubectl \

README.md

@@ -22,6 +22,7 @@ Container image based on the [GitHub Actions Runner](https://github.com/actions/
 |------|-------------|
 | [Argo Workflows CLI](https://github.com/argoproj/argo-workflows) | Workflow orchestration on Kubernetes |
 | [Kargo CLI](https://github.com/akuity/kargo) | Application lifecycle orchestration |
+| [Chainloop CLI](https://github.com/chainloop-dev/chainloop) | Supply-chain attestation craft (`CHAINLOOP_VERSION`; Velmios red control plane) |
 | [kubectl](https://kubernetes.io/docs/reference/kubectl/) | Kubernetes CLI (in-cluster kpack builds from green ARC runners) |
 | [gh](https://cli.github.com/) | GitHub CLI (`gh api` calls from workflows, e.g. dependency-graph snapshots) |
 | [jq](https://jqlang.org/) | JSON processor (kpack git-token refresher CronJob) |

manifest.yaml

@@ -8,6 +8,7 @@ build:
     - RUNNER_VERSION=2.336.0
     - ARGO_VERSION=4.0.8
     - KARGO_VERSION=1.11.0
+    - CHAINLOOP_VERSION=1.105.4
     - PACK_VERSION=0.40.8
     - CRANE_VERSION=0.21.8
     - KUBECTL_VERSION=1.36.3

renovate.json

@@ -76,6 +76,15 @@
       "datasourceTemplate": "github-releases",
       "extractVersionTemplate": "^v?(?<version>.+)$"
     },
+    {
+      "customType": "regex",
+      "description": "Update Chainloop CLI version",
+      "fileMatch": ["^Containerfile$", "^manifest\\.yaml$"],
+      "matchStrings": ["CHAINLOOP_VERSION=(?<currentValue>\\S+)"],
+      "depNameTemplate": "chainloop-dev/chainloop",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v?(?<version>.+)$"
+    },
     {
       "customType": "regex",
       "description": "Update GitHub CLI version",