DAT-21009: Add Supply Chain Security to Liquibase Secure Docker Images by jandroav · Pull Request #485 · liquibase/docker

jandroav · 2025-12-10T06:36:13Z

Summary

Adds supply chain security features to Liquibase Secure Docker images for SLSA Level 3 compliance:

SBOM generation - Software Bill of Materials attached to images
Build provenance - Cryptographic attestation of build process
Cosign signing - Keyless image signing via GitHub OIDC

Changes

.github/workflows/create-release.yml - Add SBOM, provenance, and Cosign signing for secure images only
README.md - Add "Verifying Secure Images" documentation section

Key Details

All features apply only to liquibase-secure-release (Community images unchanged)
Uses keyless signing with GitHub OIDC (no private keys stored)
Signs images on all registries (Docker Hub, GHCR, ECR) based on push flags
Skips signing during dry-run mode

Verification Commands

# Verify signature
cosign verify liquibase/liquibase-secure:latest \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp="https://github.com/liquibase/docker/.*"

# View SBOM
docker buildx imagetools inspect liquibase/liquibase-secure:latest --format '{{ json .SBOM }}'

# View provenance
docker buildx imagetools inspect liquibase/liquibase-secure:latest --format '{{ json .Provenance }}'

🤖 Generated with Claude Code

coderabbitai · 2025-12-10T06:36:32Z

📝 Walkthrough

Walkthrough

Adds SBOM and SLSA provenance generation to liquibase-secure builds, installs Cosign, and adds conditional keyless Cosign signing (Docker Hub, GHCR, ECR); updates README with verification instructions for signatures, SBOM, and provenance.

Changes

Cohort / File(s)	Summary
CI/CD Supply Chain Security `/.github/workflows/create-release.yml`	Enable `provenance: true` and `sbom: true` in `docker/build-push-action` for `liquibase-secure-release`; add Cosign installer step; add conditional keyless Cosign signing steps per registry (Docker Hub, GHCR, ECR) gated by secure-release and push flags; duplicate signing blocks for alternate workflow path.
Documentation `README.md`	Add "Verifying Secure Images" section describing Cosign keyless signature verification, SBOM inspection (`docker buildx imagetools inspect`), and provenance verification; update Dockerfile snippet to show multiple image reference options; note features apply only to Liquibase Secure images.

Sequence Diagram(s)

sequenceDiagram
  participant GH as "GitHub Actions"
  participant Build as "docker/build-push-action"
  participant Registry as "Container Registry (DockerHub / GHCR / ECR)"
  participant Cosign as "Cosign (sigstore)"

  GH->>Build: trigger secure build (provenance: true, sbom: true)
  Build->>Registry: push image + attach SBOM & provenance
  GH->>Cosign: install cosign (secure release only)
  alt pushDockerHub == true
    GH->>Cosign: keyless sign image (Docker Hub)
    Cosign->>Registry: publish signature / transparency log
  end
  alt pushGHCR == true
    GH->>Cosign: keyless sign image (GHCR)
    Cosign->>Registry: publish signature / transparency log
  end
  alt pushECR == true
    GH->>Cosign: keyless sign image (ECR)
    Cosign->>Registry: publish signature / transparency log
  end

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested labels

type: ci

Suggested reviewers

jnewton03
sayaliM0412

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically summarizes the main change: adding supply chain security features (SBOM, provenance, Cosign signing) to Liquibase Secure Docker images with SLSA Level 3 compliance.
Description check	✅ Passed	The description is comprehensive and directly related to the changeset, detailing the supply chain security features being added, affected files, implementation approach, and verification commands.
Linked Issues check	✅ Passed	The pull request successfully implements all core acceptance criteria from DAT-21009: SBOM and provenance enabled in build-push-action, Cosign installation and keyless signing implemented for secure images only, and README.md updated with verification documentation.
Out of Scope Changes check	✅ Passed	All changes are in scope and directly support the DAT-21009 objectives: workflow modifications for SBOM/provenance/signing and README updates for verification instructions; no unrelated changes detected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

.github/workflows/create-release.yml

Copilot

Pull request overview

This PR adds comprehensive supply chain security features to Liquibase Secure Docker images to achieve SLSA Level 3 compliance. The implementation includes SBOM generation, build provenance attestations, and keyless image signing using Cosign with GitHub OIDC, ensuring image authenticity and transparency without storing private keys.

Key changes:

Supply chain security features (SBOM, provenance, Cosign signing) for secure images only
Keyless signing via GitHub OIDC across all registries (Docker Hub, GHCR, ECR)
Comprehensive documentation for verifying image authenticity and viewing attestations

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
`.github/workflows/create-release.yml`	Adds Cosign installation, SBOM/provenance generation in build step, and registry-specific signing steps with proper conditionals for secure images only
`README.md`	Adds "Verifying Secure Images" section with command examples for signature verification, SBOM inspection, and provenance viewing

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

coderabbitai

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/create-release.yml (1)
369-369: Critical: Fix typo in AWS credentials reference.

Line 369 and 380 have a typo: steps.configure-aws-credentials-prodoutputs should be steps.configure-aws-credentials-prod.outputs (missing dot after prod).

Apply this diff to fix the typo:
- password: ${{ steps.configure-aws-credentials-prodoutputs.aws_secret_access_key }}
+ password: ${{ steps.configure-aws-credentials-prod.outputs.aws_secret_access_key }}
Also applies to: 380-380

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 5bc25cb and ad9649a.

📒 Files selected for processing (2)

.github/workflows/create-release.yml (4 hunks)
README.md (1 hunks)

🧰 Additional context used

🧠 Learnings (13)

📓 Common learnings

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to DockerfileSecure : Docker Secure images should use distinct tagging strategy: Git tag format `v{version}-SECURE` (e.g., `v5.0.1-SECURE`), GitHub Release labeled `v{version}-SECURE`, and Docker image tags `liquibase/liquibase-secure:{version}`, `liquibase/liquibase-secure:{major.minor}`, and `liquibase/liquibase-secure:latest`

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Secure Docker images should be published to Docker Hub as `liquibase/liquibase-secure`, GitHub Container Registry as `ghcr.io/liquibase/liquibase-secure*`, and Amazon ECR Public as `public.ecr.aws/liquibase/liquibase-secure*`

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to {Dockerfile,DockerfileSecure,Dockerfile.alpine} : Validate Liquibase and LPM binary SHA256 checksums for security in Dockerfile builds

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to {Dockerfile,docker-compose.yml} : Docker Community images should use distinct tagging strategy: Git tag format `v{version}` (e.g., `v5.0.1`), GitHub Release labeled `v{version}`, and Docker image tags `liquibase/liquibase:{version}`, `liquibase/liquibase:{major.minor}`, and `liquibase/liquibase:latest`

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to DockerfileSecure : Secure Liquibase versions should be sourced from repo.liquibase.com and controlled via `LIQUIBASE_PRO_VERSION` ARG

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to **/Dockerfile* : When extending Secure images, use `FROM liquibase/liquibase-secure:latest` as the base and set `LIQUIBASE_LICENSE_KEY` environment variable

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to {Dockerfile,DockerfileSecure,Dockerfile.alpine} : When adding tools or runtime dependencies to images, switch to root user, run apt-get operations, and switch back to non-root `liquibase` user in multi-step processes

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to Dockerfile : Community Liquibase versions should be sourced from GitHub releases and controlled via `LIQUIBASE_VERSION` ARG

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Community Docker images should be published to Docker Hub as `liquibase/liquibase`, GitHub Container Registry as `ghcr.io/liquibase/liquibase*`, and Amazon ECR Public as `public.ecr.aws/liquibase/liquibase*`