DAT-21009: Add Supply Chain Security to Liquibase Secure Docker Images #485

jandroav · 2025-12-10T06:36:13Z

Summary

Adds supply chain security features to Liquibase Secure Docker images for SLSA Level 3 compliance:

SBOM generation - Software Bill of Materials attached to images
Build provenance - Cryptographic attestation of build process
Cosign signing - Keyless image signing via GitHub OIDC

Changes

.github/workflows/create-release.yml - Add SBOM, provenance, and Cosign signing for secure images only
README.md - Add "Verifying Secure Images" documentation section

Key Details

All features apply only to liquibase-secure-release (Community images unchanged)
Uses keyless signing with GitHub OIDC (no private keys stored)
Signs images on all registries (Docker Hub, GHCR, ECR) based on push flags
Skips signing during dry-run mode

Verification Commands

# Verify signature
cosign verify liquibase/liquibase-secure:latest \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp="https://github.com/liquibase/docker/.*"

# View SBOM
docker buildx imagetools inspect liquibase/liquibase-secure:latest --format '{{ json .SBOM }}'

# View provenance
docker buildx imagetools inspect liquibase/liquibase-secure:latest --format '{{ json .Provenance }}'

🤖 Generated with Claude Code

Add SBOM generation, SLSA Level 3 provenance attestation, and Cosign keyless image signing for Liquibase Secure Docker images only. Changes: - Add SBOM and provenance to docker/build-push-action for secure images - Install Cosign and sign images on Docker Hub, GHCR, and ECR - Add "Verifying Secure Images" documentation to README.md Community images remain unchanged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]>

coderabbitai · 2025-12-10T06:36:32Z

📝 Walkthrough

Walkthrough

This PR implements supply chain security features for Liquibase Secure Docker images by enabling SBOM generation and provenance attestation in the build process, adding Cosign-based keyless image signing for Docker Hub, GHCR, and ECR, and documenting verification procedures in the README.

Changes

Cohort / File(s)	Summary
CI/CD Supply Chain Security `.github/workflows/create-release.yml`	Adds Cosign installation step, enables SBOM and provenance generation in docker/build-push-action, and introduces three new Cosign signing steps (Docker Hub, GHCR, ECR) that sign images using GitHub OIDC keyless authentication after successful push operations. Changes are gated to liquibase-secure-release workflow variant.
Documentation `README.md`	Adds new "Verifying Secure Images" section documenting supply chain security features specific to Liquibase Secure images, including instructions for verifying image signatures with Cosign, viewing SBOM, and viewing build provenance via image tooling.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20–25 minutes

Verify proper conditional gating ensures signing only applies to liquibase-secure-release variant and when registry push flags are enabled
Confirm Cosign signing steps use correct image digest references from preceding build/push steps
Validate COSIGN_EXPERIMENTAL: 1 environment variable is correctly set for keyless GitHub OIDC signing across all three signing steps
Ensure signing operations occur after image push completion to avoid timing issues with registry availability

Suggested reviewers

jnewton03
sayaliM0412

Pre-merge checks and finishing touches

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and accurately summarizes the main change: adding supply chain security features (SBOM, provenance, Cosign signing) to Liquibase Secure Docker images.
Description check	✅ Passed	The description provides comprehensive details about the supply chain security features being added, explains which images are affected, and includes verification commands, all directly related to the changeset.
Linked Issues check	✅ Passed	The PR fulfills the core requirements from DAT-21009: enables SBOM and provenance in build-push-action, adds Cosign installation and keyless signing steps, implements registry-specific signing, and updates README with verification documentation.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to the objectives in DAT-21009: workflow modifications for SBOM/provenance/signing for liquibase-secure-release only, and README documentation updates for verification. No unrelated or extraneous changes detected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch DAT-21009

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

.github/workflows/create-release.yml

+      # Install Cosign for keyless image signing (Secure images only)
+      - name: Install Cosign
+        if: ${{ matrix.type == 'liquibase-secure-release' }}
+        uses: sigstore/cosign-installer@v3


Copilot

Pull request overview

This PR adds comprehensive supply chain security features to Liquibase Secure Docker images to achieve SLSA Level 3 compliance. The implementation includes SBOM generation, build provenance attestations, and keyless image signing using Cosign with GitHub OIDC, ensuring image authenticity and transparency without storing private keys.

Key changes:

Supply chain security features (SBOM, provenance, Cosign signing) for secure images only
Keyless signing via GitHub OIDC across all registries (Docker Hub, GHCR, ECR)
Comprehensive documentation for verifying image authenticity and viewing attestations

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
`.github/workflows/create-release.yml`	Adds Cosign installation, SBOM/provenance generation in build step, and registry-specific signing steps with proper conditionals for secure images only
`README.md`	Adds "Verifying Secure Images" section with command examples for signature verification, SBOM inspection, and provenance viewing

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

coderabbitai

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/create-release.yml (1)
369-369: Critical: Fix typo in AWS credentials reference.

Line 369 and 380 have a typo: steps.configure-aws-credentials-prodoutputs should be steps.configure-aws-credentials-prod.outputs (missing dot after prod).

Apply this diff to fix the typo:
- password: ${{ steps.configure-aws-credentials-prodoutputs.aws_secret_access_key }}
+ password: ${{ steps.configure-aws-credentials-prod.outputs.aws_secret_access_key }}
Also applies to: 380-380

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 5bc25cb and ad9649a.

📒 Files selected for processing (2)

.github/workflows/create-release.yml (4 hunks)
README.md (1 hunks)

🧰 Additional context used

🧠 Learnings (13)

📓 Common learnings

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to DockerfileSecure : Docker Secure images should use distinct tagging strategy: Git tag format `v{version}-SECURE` (e.g., `v5.0.1-SECURE`), GitHub Release labeled `v{version}-SECURE`, and Docker image tags `liquibase/liquibase-secure:{version}`, `liquibase/liquibase-secure:{major.minor}`, and `liquibase/liquibase-secure:latest`

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Secure Docker images should be published to Docker Hub as `liquibase/liquibase-secure`, GitHub Container Registry as `ghcr.io/liquibase/liquibase-secure*`, and Amazon ECR Public as `public.ecr.aws/liquibase/liquibase-secure*`

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to {Dockerfile,DockerfileSecure,Dockerfile.alpine} : Validate Liquibase and LPM binary SHA256 checksums for security in Dockerfile builds

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to {Dockerfile,docker-compose.yml} : Docker Community images should use distinct tagging strategy: Git tag format `v{version}` (e.g., `v5.0.1`), GitHub Release labeled `v{version}`, and Docker image tags `liquibase/liquibase:{version}`, `liquibase/liquibase:{major.minor}`, and `liquibase/liquibase:latest`

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to DockerfileSecure : Secure Liquibase versions should be sourced from repo.liquibase.com and controlled via `LIQUIBASE_PRO_VERSION` ARG

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to **/Dockerfile* : When extending Secure images, use `FROM liquibase/liquibase-secure:latest` as the base and set `LIQUIBASE_LICENSE_KEY` environment variable

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to {Dockerfile,DockerfileSecure,Dockerfile.alpine} : When adding tools or runtime dependencies to images, switch to root user, run apt-get operations, and switch back to non-root `liquibase` user in multi-step processes

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Applies to Dockerfile : Community Liquibase versions should be sourced from GitHub releases and controlled via `LIQUIBASE_VERSION` ARG

Learnt from: CR
Repo: liquibase/docker PR: 0
File: CLAUDE.md:0-0
Timestamp: 2025-11-24T16:48:37.150Z
Learning: Community Docker images should be published to Docker Hub as `liquibase/liquibase`, GitHub Container Registry as `ghcr.io/liquibase/liquibase*`, and Amazon ECR Public as `public.ecr.aws/liquibase/liquibase*`