feat(supply-chain): sign published images and generate the chart image inventory

Enterprise security reviews ask for three artifacts Sim did not publish: a
signature proving who built an image, SLSA provenance describing how, and an
SBOM listing what is inside. Add all three, plus the image inventory an
operator needs to mirror Sim into a disconnected registry.

attest-images runs after create-ghcr-manifests rather than inside the build.
buildx's own provenance/sbom attestations stay off because the extra manifests
they add to an index break the imagetools retagging promote-images depends on;
attaching attestations to the finished index leaves it untouched, since they
are stored as separate referrer manifests. The subject is the sha index digest
— imagetools create is deterministic, so the version and latest indexes built
from the same per-arch manifests share that digest and one attestation covers
every tag a customer can pull.

The digest comes from `{{json .Manifest}}` piped through jq rather than
`{{.Manifest.Digest}}`: the latter resolves the index to the runner's own
platform, which would attest one architecture and leave the pulled index
unsigned.

helm/sim/images.yaml is derived from the rendered chart, not from values.yaml,
because one image is written directly into a template — the NVIDIA device
plugin — and a values-derived list misses it in the case that is hardest to
notice, where the mirror succeeds and one pod still pulls from the internet.
Tags stay unresolved: digests belong to a release, and the chart's sim.image
helper already accepts a per-image digest for pinning at install time.

The check runs in the helm workflow, which has Helm set up; check:audits does
not.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015BwsJTEQRzWJaY4BRCkPZt

Author: waleedlatif1

.github/workflows/ci.yml

@@ -611,6 +611,108 @@ jobs:
               "${IMAGE}:${SHA}-amd64" "${IMAGE}:${SHA}-arm64"
           fi
 
+  # Sign the published images and attach SLSA provenance and an SBOM to each.
+  #
+  # This runs after create-ghcr-manifests rather than inside the build because
+  # buildx's own provenance/sbom attestations stay off (see the note in
+  # .github/actions/docker-build): the extra manifests they add to an index
+  # break the `imagetools create` retagging that promote-images depends on.
+  # Attaching attestations here instead leaves the index itself untouched — they
+  # are stored as separate referrer manifests that point at it.
+  #
+  # The subject is the sha index digest. `imagetools create` builds the version
+  # and latest indexes from the same two per-arch manifests in the same order,
+  # so all three tags resolve to one digest and a single attestation covers
+  # every tag a customer can pull.
+  attest-images:
+    name: Attest Images
+    runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-2vcpu-ubuntu-2404' || 'ubuntu-latest' }}
+    timeout-minutes: 15
+    needs: [create-ghcr-manifests]
+    if: >-
+      !cancelled() &&
+      needs.create-ghcr-manifests.result == 'success' &&
+      github.event_name == 'push' && github.ref == 'refs/heads/main'
+    permissions:
+      contents: read
+      packages: write
+      # Sigstore signs against the runner's OIDC identity; no key material is stored.
+      id-token: write
+      attestations: write
+    strategy:
+      fail-fast: false
+      matrix:
+        image:
+          - ghcr.io/simstudioai/simstudio
+          - ghcr.io/simstudioai/migrations
+          - ghcr.io/simstudioai/realtime
+          - ghcr.io/simstudioai/pii
+          - ghcr.io/simstudioai/cron
+
+    steps:
+      - name: Login to GHCR
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Resolved once and reused by every step below: signing a tag would sign
+      # whatever that tag points at when the step runs, which is not necessarily
+      # what this run published.
+      #
+      # `{{json .Manifest}}` piped through jq, not `{{.Manifest.Digest}}` — the
+      # latter resolves the index to the runner's own platform and prints that
+      # manifest's digest instead, which would attest one architecture and leave
+      # the index a customer actually pulls unsigned.
+      - name: Resolve index digest
+        id: digest
+        run: |
+          DIGEST="$(docker buildx imagetools inspect "${{ matrix.image }}:${{ github.sha }}" \
+            --format '{{json .Manifest}}' | jq -r '.digest')"
+          if [ -z "$DIGEST" ] || [ "$DIGEST" = "null" ]; then
+            echo "::error::Could not resolve a digest for ${{ matrix.image }}:${{ github.sha }}"
+            exit 1
+          fi
+          echo "value=${DIGEST}" >> "$GITHUB_OUTPUT"
+
+      - name: Generate SBOM
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        with:
+          image: ${{ matrix.image }}@${{ steps.digest.outputs.value }}
+          format: spdx-json
+          output-file: sbom.spdx.json
+          # The action's own release upload is for workflows triggered by a
+          # release; these attach to the image instead.
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Attest SBOM
+        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
+        with:
+          subject-name: ${{ matrix.image }}
+          subject-digest: ${{ steps.digest.outputs.value }}
+          sbom-path: sbom.spdx.json
+          # Stored alongside the image so a mirrored registry carries the
+          # attestation with it, rather than only being retrievable from GitHub.
+          push-to-registry: true
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-name: ${{ matrix.image }}
+          subject-digest: ${{ steps.digest.outputs.value }}
+          push-to-registry: true
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      # The attestations above prove how the image was built; this is the plain
+      # signature that admission controllers (Kyverno, the Sigstore policy
+      # controller) verify before admitting a pod.
+      - name: Sign image
+        run: cosign sign --yes "${{ matrix.image }}@${{ steps.digest.outputs.value }}"
+
   # Check if docs changed
   # Smallest runner on purpose: a depth-2 checkout plus a path filter, no
   # install and no build.

.github/workflows/helm.yml

@@ -43,6 +43,13 @@ jobs:
       - name: Scheduler parity (docker/crontab vs helm cronjobs)
         run: bun run scripts/check-cron-parity.ts
 
+      # helm/sim/images.yaml is what an operator mirrors into a disconnected
+      # registry, so a chart change that adds an image has to update it. Lives
+      # here rather than in `check:audits` because it renders the chart, and the
+      # audits job has no Helm. The script imports only node builtins.
+      - name: Image inventory is current
+        run: bun run images:check
+
       - name: Helm lint
         run: helm lint helm/sim --values helm/sim/ci/default-values.yaml
 

helm/sim/images.yaml

@@ -0,0 +1,23 @@
+# Generated by `bun run images:generate`. Do not edit this file directly.
+#
+# Every container image a complete Sim install pulls, rendered from this chart
+# with all optional components enabled. Mirror all of them into a disconnected
+# registry before installing, then point the chart at your registry with
+# `global.imageRegistry` and pin each image's `digest` to what your mirror
+# resolved.
+chartVersion: 1.8.0
+appVersion: v0.8.18
+images:
+  - busybox:1.36
+  - curlimages/curl:8.5.0
+  - ghcr.io/simstudioai/copilot:v0.8.18
+  - ghcr.io/simstudioai/migrations:v0.8.18
+  - ghcr.io/simstudioai/pii:v0.8.18
+  - ghcr.io/simstudioai/realtime:v0.8.18
+  - ghcr.io/simstudioai/simstudio:v0.8.18
+  - nvcr.io/nvidia/k8s-device-plugin:v0.18.2
+  - ollama/ollama:0.23.2
+  - otel/opentelemetry-collector-contrib:0.91.0
+  - pgvector/pgvector:pg17
+  - postgres:17-alpine
+  - redis:7-alpine

package.json

@@ -79,6 +79,8 @@
     "tool-metadata:check": "bun run scripts/sync-tool-metadata.ts --check",
     "deployment-config:generate": "bun run scripts/generate-deployment-config.ts",
     "deployment-config:check": "bun run scripts/generate-deployment-config.ts --check",
+    "images:generate": "bun run scripts/generate-image-manifest.ts",
+    "images:check": "bun run scripts/generate-image-manifest.ts --check",
     "integration-catalog:check": "bun run scripts/check-integration-catalog.ts",
     "docs:check": "bun run scripts/generate-docs.ts --check",
     "mship-tools:generate": "bun run scripts/sync-tool-catalog.ts",

scripts/generate-image-manifest.test.ts

@@ -0,0 +1,93 @@
+import { describe, expect, it } from 'vitest'
+import { collectImages, renderManifest } from './generate-image-manifest'
+
+describe('collectImages', () => {
+  it('finds images across every container key a pod spec can use', () => {
+    const images = collectImages([
+      {
+        kind: 'Deployment',
+        spec: {
+          template: {
+            spec: {
+              initContainers: [{ image: 'ghcr.io/simstudioai/migrations:v1' }],
+              containers: [{ image: 'ghcr.io/simstudioai/simstudio:v1' }],
+              ephemeralContainers: [{ image: 'busybox:1.36' }],
+            },
+          },
+        },
+      },
+    ])
+
+    expect(images).toEqual([
+      'busybox:1.36',
+      'ghcr.io/simstudioai/migrations:v1',
+      'ghcr.io/simstudioai/simstudio:v1',
+    ])
+  })
+
+  it('reaches containers nested below a workload wrapper', () => {
+    const images = collectImages([
+      {
+        kind: 'CronJob',
+        spec: {
+          jobTemplate: {
+            spec: { template: { spec: { containers: [{ image: 'curlimages/curl:8.5.0' }] } } },
+          },
+        },
+      },
+    ])
+
+    expect(images).toEqual(['curlimages/curl:8.5.0'])
+  })
+
+  it('deduplicates the same image pulled by several workloads', () => {
+    const container = { containers: [{ image: 'redis:7-alpine' }] }
+    const images = collectImages([
+      { spec: { template: { spec: container } } },
+      { spec: { template: { spec: container } } },
+    ])
+
+    expect(images).toEqual(['redis:7-alpine'])
+  })
+
+  it('ignores an image field that is not a container image', () => {
+    const images = collectImages([{ metadata: { annotations: { image: 'not-a-container' } } }])
+
+    expect(images).toEqual([])
+  })
+
+  it('skips a container whose image is absent or empty', () => {
+    const images = collectImages([
+      { spec: { containers: [{ name: 'no-image' }, { image: '' }, { image: 'busybox:1.36' }] } },
+    ])
+
+    expect(images).toEqual(['busybox:1.36'])
+  })
+
+  it('tolerates null entries rather than throwing on a sparse render', () => {
+    const images = collectImages([null, { spec: { containers: [null, { image: 'redis:7' }] } }])
+
+    expect(images).toEqual(['redis:7'])
+  })
+})
+
+describe('renderManifest', () => {
+  it('renders versions and a sorted image list', () => {
+    const manifest = renderManifest({
+      chartVersion: '1.8.0',
+      appVersion: 'v0.8.18',
+      images: ['busybox:1.36', 'redis:7-alpine'],
+    })
+
+    expect(manifest).toContain('chartVersion: 1.8.0')
+    expect(manifest).toContain('appVersion: v0.8.18')
+    expect(manifest).toContain('  - busybox:1.36\n  - redis:7-alpine\n')
+  })
+
+  it('ends with a trailing newline so the checked-in file is POSIX-clean', () => {
+    const manifest = renderManifest({ chartVersion: '1.0.0', appVersion: 'v1', images: ['a:1'] })
+
+    expect(manifest.endsWith('\n')).toBe(true)
+    expect(manifest.endsWith('\n\n')).toBe(false)
+  })
+})