Repository navigation
fix: scan WordPress image before publishing and use mmmcp - #15
calvinmclean wants to merge 7 commits into
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The container build ignores the committed dependency lockfile, allowing untested dependency drift.
Review effort: Balanced
Findings: 1
What changed in this PR
Updates container publishing so multi-platform images are scanned before publication and served through mmmcp.
Changes:
- Builds and scans amd64/arm64 OCI images before pushing.
- Replaces nanobot with mmmcp on a Wolfi/Python runtime.
- Uploads platform-specific SARIF reports and signs the published digest.
| File | Description |
|---|---|
Dockerfile |
Builds the runtime with mmmcp, uv, and Wolfi Python. |
.github/workflows/docker-build-and-push.yml |
Adds pre-publish scanning, OCI publication, signing, and release tagging. |
.github/scripts/select-oci-platform.py |
Creates single-platform OCI views for scanning. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| env: | ||
| IMAGE_TAG: ghcr.io/${{ github.repository }}:${{ github.ref_name }} | ||
| run: | | ||
| image_ref=$(crane push --index "$RUNNER_TEMP/image-layout" "$IMAGE_TAG") |
There was a problem hiding this comment.
My agent says that --index should be removed, because it results in an index wrapped in another index. Normal containerd-based clients would still be able to use the image, but this is abnormal.
| for platform in linux/amd64 linux/arm64; do | ||
| arch="${platform#*/}" | ||
| trivy image --input "$RUNNER_TEMP/image-${arch}" \ | ||
| --skip-dirs '**/venv' --format sarif --output "trivy-results-${arch}.sarif" |
There was a problem hiding this comment.
Double check whether we should be skipping **/venv or **/.venv.
|
converting to draft for now and removing reviewers so it's out of the way for v0.27 release |
Problem
The build job pushes to GHCR before enforcing its Trivy vulnerability policy. A run can fail while
:mainhas already moved to the new image. The current nanobot base also has HIGH findings that would block publication once the scan runs first.Changes
:latesttagging.