refactor(sbom, vex): integrate new stages into build conveyor - #286
Draft
nervgh wants to merge 17 commits into
Draft
refactor(sbom, vex): integrate new stages into build conveyor#286nervgh wants to merge 17 commits into
nervgh wants to merge 17 commits into
Conversation
nervgh
force-pushed
the
refactor/vex/integrate-into-build-conveyor
branch
2 times, most recently
from
September 1, 2026 13:44
c3095d6 to
eac5514
Compare
nervgh
changed the title
nervgh
changed the title
Specify deterministic artifact generation, propagation, caching, and cleanup across primary, final, and cache repositories. Ensure platform-specific SBOM and image-level VEX placement while preserving fallback-tag storage semantics. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Describe the staged lifecycle, artifact identity, subject selection, and propagation rules. Capture registry validation and verification scenarios before implementation replaces the post-build convergence path. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Define phased implementation, testing, propagation, caching, failure handling, and validation work before changing implementation code. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Model SBOM and VEX as mutable, non-buildable stages attached to their parent image. Propagate artifacts to final and cache repositories, validate artifact storage, and clean orphaned cache artifacts. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Define `SbomStage` and `VexStage` as the sole owners of artifact generation, caching, signing, and publication instead of retaining transitional step implementations. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Run restored artifact stages after cached image content is found and keep artifact stages out of non-empty stage tracking. Rename SBOM and VEX processors to reflect their lifecycle-owned roles. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Move repository selection into StorageManager so artifact operations use the appropriate primary, secondary, cache, or final backend instead of receiving storage backends directly. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Use the dedicated MutateArtifact lifecycle and StorageManager for registry publication, replacing transitional post-build step implementations. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Route SBOM and VEX stages through the artifact lifecycle instead of treating them as image mutations. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Centralize SBOM and VEX artifact reads, writes, and copies through StorageManager instead of accessing storage implementations directly. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Preserve platform metadata and use destination digests when attaching artifacts, preventing platform subjects from being matched by index order. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Prevent cache restoration from re-running regular image stages and duplicating work. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Exercise missing and unreachable registry paths to ensure artifact generation fails before image work and reports storage initialization errors. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Add SBOM and VEX coverage for cache and final repository failures, local artifact retrieval, and missing secondary fallback indexes. Mark the corresponding specification task complete. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Exercise primary, final, cache, identical-address, and secondary-repository scenarios to verify SBOM artifacts remain available across destinations. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Record successful build and unit-suite checks while leaving legacy integration coverage pending. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
nervgh
force-pushed
the
refactor/vex/integrate-into-build-conveyor
branch
from
September 2, 2026 20:19
15ba742 to
d8c9e5a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.