fix(ci): pin Trivy scan to the matrix platform so the arm64 release gate passes#163
Merged
Merged
Conversation
…ate passes The first real run of the signed release pipeline (v0.7.0) failed: the arm64 build's Trivy scan errored with 'no child with platform linux/amd64 in index', which skipped the release gate and therefore ALL publishing (NuGet, Docker, docs, signing). Nothing shipped. Root cause: on a real release the build pushes by digest with SBOM + provenance (mode=max), so buildx wraps each single-arch image in an index (the image manifest plus attestation manifests). Given an index reference, Trivy resolves to its default platform linux/amd64 regardless of the runner architecture — so the arm64 job (on a native arm64 runner) asked for a linux/amd64 child that an arm64-only index does not contain. The amd64 job passed only because its default happened to match. The dry-run never caught this: it loads a single-platform image into the local daemon (type=docker, no attestations, no index), a different code path than the pushed-by-digest index the real release scans. Fix: set TRIVY_PLATFORM to the matrix platform so each job scans its own arch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What happened
The first real run of the signed release pipeline (v0.7.0) failed and shipped nothing. The
Build Docker (arm64)job's Trivy scan errored with:That failed the arm64 build → the release gate was skipped → Publish NuGet, Publish Docker, Deploy Docs, and Supply-chain (sign + SBOM) were all skipped. Tests, amd64 build, docs build, and NuGet pack were green; only the arm64 Trivy step failed.
Root cause
On a real release the build pushes each arch by digest with
sbom+provenance: mode=max, so buildx wraps the single-arch image in an index (image manifest + attestation manifests). Given an index reference, Trivy resolves to its default platformlinux/amd64regardless of the runner architecture. So the arm64 job (on a nativeubuntu-24.04-armrunner) asked for alinux/amd64child that an arm64-only index does not contain. The amd64 job passed only because its default happened to match.The dry-run never caught this: it loads a single-platform image into the local daemon (
type=docker, no attestations, no index) — a different code path than the pushed-by-digest index the real release scans.Fix
Set
TRIVY_PLATFORMto the matrix platform so each job scans its own arch. One env var, no behaviour change to what gets scanned — both platforms' package sets are still scanned, now correctly resolved.After merge
v0.7.0 published nothing, so it needs re-running once this lands. The pipeline was built for exactly this ("republishing a botched release after fixing pipeline logic" — the
workflow_dispatchpath withversion_override+dry_run=false). Recommend re-running the release for 0.7.0 from the fixeddevelop.🤖 Generated with Claude Code