fix(ci): defer release aliases until security gates pass (#1763)

Signed-off-by: Mark Chmarny <mark@chmarny.com>

Author: mchmarny

.github/actions/README.md

@@ -92,16 +92,25 @@ This action runs `tools/setup-tools --skip-go --skip-docker` in auto mode, which
 ```
 
 #### `go-build-release/`
-**Purpose**: Complete build and release pipeline (tools + auth + make release)
+**Purpose**: Validate the exact-tag release target, then run the complete build
+and release pipeline (tools + auth + make release)
 **When to use**: Release workflows that build and publish artifacts
 **Inputs**:
 - `registry` (optional): Container registry (default: "ghcr.io")
+- `ko_version` (optional): Ko version (default: "v0.18.0")
 - `goreleaser_version` (required): GoReleaser version from `load-versions`
+- `go_licenses_version` (required): go-licenses version from `load-versions`
+- `candidate_tag` (required): Validated `candidate-<run-id>-<run-attempt>` image tag
 
 **Outputs**:
 - `release_outcome`: Release step outcome (success/failure)
 
-**Note**: Image repository paths are fully specified in `.goreleaser.yaml` under `kos.repositories`.
+**Note**: A partial draft is reused only when its name and tag both equal the
+release tag, its pre-release state matches, and its existing assets are a safe
+subset of the fixed release asset set. Unexpected draft assets and
+already-public releases are rejected before GoReleaser runs, and reused draft
+notes are replaced with notes generated from the current tag. Image repository
+paths are fully specified in `.goreleaser.yaml` under `kos.repositories`.
 
 **Example**:
 ```yaml
@@ -110,7 +119,10 @@ This action runs `tools/setup-tools --skip-go --skip-docker` in auto mode, which
 - uses: ./.github/actions/go-build-release
   id: release
   with:
+    ko_version: ${{ steps.versions.outputs.ko }}
     goreleaser_version: ${{ steps.versions.outputs.goreleaser }}
+    go_licenses_version: ${{ steps.versions.outputs.go_licenses }}
+    candidate_tag: ${{ needs.detect.outputs.candidate_tag }}
 - if: steps.release.outputs.release_outcome == 'success'
   run: echo "Release succeeded"
 ```
@@ -130,11 +142,13 @@ This action runs `tools/setup-tools --skip-go --skip-docker` in auto mode, which
 ```
 
 #### `attest-image-from-tag/`
-**Purpose**: Resolve digest from tag and generate SBOM + provenance  
-**When to use**: Attesting images by tag (typical release workflow)  
+**Purpose**: Bind a fixed AICR candidate image to an authoritative digest and
+generate SBOM + provenance
+**When to use**: Attesting candidate images in the AICR release workflow
 **Inputs**:
-- `image_name` (required): Full image name without tag (e.g., "ghcr.io/org/image")
-- `tag` (required): Image tag (e.g., "v1.2.3")
+- `image_name` (required): One of the seven fixed AICR release image names
+- `candidate_tag` (required): Validated `candidate-<run-id>-<run-attempt>` tag
+- `expected_digest` (required): Authoritative `sha256:<64 lowercase hex>` digest
 - `crane_version` (optional): crane version (default: "v0.20.6")
 
 **Outputs**:
@@ -144,23 +158,26 @@ This action runs `tools/setup-tools --skip-go --skip-docker` in auto mode, which
 ```yaml
 - uses: ./.github/actions/attest-image-from-tag
   with:
-    image_name: ghcr.io/${{ github.repository_owner }}/my-app
-    tag: ${{ github.ref_name }}
+    image_name: ghcr.io/nvidia/aicrd
+    candidate_tag: candidate-${{ github.run_id }}-${{ github.run_attempt }}
+    expected_digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
 ```
 
 #### `sbom-and-attest/`
+
 **Purpose**: Generate SBOM and attestations for image with known digest  
 **When to use**: When you already have the digest (e.g., from build output)  
 **Inputs**:
-- `image_name` (required): Full image name
+- `image_name` (required): One of the seven fixed AICR release image names
 - `image_digest` (required): sha256 digest
 
 **Example**:
+
 ```yaml
 - uses: ./.github/actions/sbom-and-attest
   with:
-    image_name: ghcr.io/org/image
-    image_digest: sha256:abc123...
+    image_name: ghcr.io/nvidia/aicrd
+    image_digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
 ```
 
 ### KWOK Testing Actions
@@ -236,12 +253,17 @@ This action runs `tools/setup-tools --skip-go --skip-docker` in auto mode, which
 **Trigger**: Semantic version tags (v*.*.*)
 **Purpose**: Build, release, attest, deploy
 **Jobs**:
-1. **Unit Tests** (parallel): Go CI + security scan
-2. **Integration Tests** (parallel): CLI integration tests
-3. **E2E Tests** (parallel): Full end-to-end tests
-4. **Build and Release** (after tests): GoReleaser builds binaries and images to GHCR
-5. **Attest Images** (after build): SBOM and provenance for aicr and aicrd images
-6. **Deploy Demo API Server** (after attest): Copy image to Artifact Registry and deploy demo to Cloud Run (example deployment)
+1. **Qualification**: Reusable test, lint, E2E, and source-security gates
+2. **Candidate Builds**: Draft release artifacts and all seven images under one
+   run-unique candidate tag
+3. **Digest Resolution**: One authoritative seven-image digest map
+4. **Image Security**: Both platforms of every resolved digest are scanned
+5. **Attestation**: Platform SBOMs and reusable-workflow provenance for the same digests
+6. **Promotion**: Read-only preflight, all version aliases, then stable `latest`
+   aliases only after every version alias is verified
+7. **Publication**: Require the exact release asset set, then publish the
+   validated numeric GitHub release ID
+8. **Stable Distribution**: Publish Homebrew and deploy the demo after publication
 
 ### `test-deploy.yaml`
 **Trigger**: Manual (workflow_dispatch)
@@ -336,11 +358,15 @@ jobs:
       - uses: ./.github/actions/go-build-release
         id: release
         with:
+          ko_version: ${{ steps.versions.outputs.ko }}
           goreleaser_version: ${{ steps.versions.outputs.goreleaser }}
+          go_licenses_version: ${{ steps.versions.outputs.go_licenses }}
+          candidate_tag: candidate-${{ github.run_id }}-${{ github.run_attempt }}
       - uses: ./.github/actions/attest-image-from-tag
         with:
           image_name: ghcr.io/nvidia/aicrd
-          tag: ${{ github.ref_name }}
+          candidate_tag: candidate-${{ github.run_id }}-${{ github.run_attempt }}
+          expected_digest: sha256:0000000000000000000000000000000000000000000000000000000000000000
           crane_version: ${{ steps.versions.outputs.crane }}
 ```
 

.github/actions/attest-image-from-tag/action.yml

@@ -19,8 +19,11 @@ inputs:
   image_name:
     description: 'Full image name (without tag or digest), e.g. ghcr.io/org/image'
     required: true
-  tag:
-    description: 'Image tag to resolve (e.g. v1.2.3)'
+  candidate_tag:
+    description: 'Run-unique candidate tag to resolve'
+    required: true
+  expected_digest:
+    description: 'Authoritative digest that the candidate must resolve to'
     required: true
   crane_version:
     description: 'crane version to install (e.g. v0.20.6)'
@@ -36,17 +39,40 @@ runs:
   using: 'composite'
   steps:
     - name: Validate inputs
+      id: validate
       shell: bash
+      env:
+        INPUT_IMAGE_NAME: ${{ inputs.image_name }}
+        INPUT_CANDIDATE_TAG: ${{ inputs.candidate_tag }}
+        INPUT_EXPECTED_DIGEST: ${{ inputs.expected_digest }}
+        INPUT_CRANE_VERSION: ${{ inputs.crane_version }}
       run: |
         set -euo pipefail
-        if [[ -z "${{ inputs.image_name }}" ]]; then
-          echo "::error::image_name is required"
+        # shellcheck source=.github/actions/release-input-validation.sh
+        source "${GITHUB_ACTION_PATH}/../release-input-validation.sh"
+        reject_newline image_name "${INPUT_IMAGE_NAME}"
+        reject_newline candidate_tag "${INPUT_CANDIDATE_TAG}"
+        reject_newline expected_digest "${INPUT_EXPECTED_DIGEST}"
+        reject_newline crane_version "${INPUT_CRANE_VERSION}"
+        require_release_image "${INPUT_IMAGE_NAME}"
+        if [[ ! "${INPUT_CANDIDATE_TAG}" =~ ^candidate-[0-9]+-[0-9]+$ ]]; then
+          echo "::error::candidate_tag must match candidate-RUN_ID-RUN_ATTEMPT"
+          exit 1
+        fi
+        if [[ ! "${INPUT_EXPECTED_DIGEST}" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+          echo "::error::expected_digest is malformed"
           exit 1
         fi
-        if [[ -z "${{ inputs.tag }}" ]]; then
-          echo "::error::tag is required"
+        if [[ ! "${INPUT_CRANE_VERSION}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          echo "::error::crane_version must use vMAJOR.MINOR.PATCH"
           exit 1
         fi
+        {
+          echo "image_name=${INPUT_IMAGE_NAME}"
+          echo "candidate_tag=${INPUT_CANDIDATE_TAG}"
+          echo "expected_digest=${INPUT_EXPECTED_DIGEST}"
+          echo "crane_version=${INPUT_CRANE_VERSION}"
+        } >> "$GITHUB_OUTPUT"
 
     - name: Authenticate to registry
       uses: ./.github/actions/ghcr-login
@@ -55,22 +81,30 @@ runs:
       uses: ./.github/actions/setup-build-tools
       with:
         install_crane: 'true'
-        crane_version: ${{ inputs.crane_version }}
+        crane_version: ${{ steps.validate.outputs.crane_version }}
 
     - name: Resolve image digest
       id: digest
       shell: bash
+      env:
+        IMAGE_NAME: ${{ steps.validate.outputs.image_name }}
+        CANDIDATE_TAG: ${{ steps.validate.outputs.candidate_tag }}
+        EXPECTED_DIGEST: ${{ steps.validate.outputs.expected_digest }}
       run: |
         set -euo pipefail
-        DIGEST="$(crane digest "${{ inputs.image_name }}:${{ inputs.tag }}")"
+        DIGEST="$(timeout --foreground 120s crane digest "${IMAGE_NAME}:${CANDIDATE_TAG}")"
         if [[ ! "$DIGEST" =~ ^sha256:[a-f0-9]{64}$ ]]; then
           echo "::error::unexpected digest format: $DIGEST"
           exit 1
         fi
+        if [[ "${DIGEST}" != "${EXPECTED_DIGEST}" ]]; then
+          echo "::error::resolved digest does not match expected digest"
+          exit 1
+        fi
         echo "image_digest=$DIGEST" >> "$GITHUB_OUTPUT"
 
     - name: Generate SBOM and attestations
       uses: ./.github/actions/sbom-and-attest
       with:
-        image_name: ${{ inputs.image_name }}
-        image_digest: ${{ steps.digest.outputs.image_digest }}
+        image_name: ${{ steps.validate.outputs.image_name }}
+        image_digest: ${{ steps.validate.outputs.expected_digest }}

.github/actions/go-build-release/action.yml

@@ -30,10 +30,9 @@ inputs:
   go_licenses_version:
     description: 'go-licenses version (from .settings.yaml)'
     required: true
-  homebrew_deploy_key:
-    description: 'SSH deploy key for pushing Homebrew formula'
-    required: false
-    default: ''
+  candidate_tag:
+    description: 'Run-unique candidate image tag'
+    required: true
 
 outputs:
   release_outcome:
@@ -43,19 +42,62 @@ outputs:
 runs:
   using: 'composite'
   steps:
+    - name: Validate inputs
+      id: validate
+      shell: bash
+      env:
+        INPUT_REGISTRY: ${{ inputs.registry }}
+        INPUT_KO_VERSION: ${{ inputs.ko_version }}
+        INPUT_GORELEASER_VERSION: ${{ inputs.goreleaser_version }}
+        INPUT_GO_LICENSES_VERSION: ${{ inputs.go_licenses_version }}
+        INPUT_CANDIDATE_TAG: ${{ inputs.candidate_tag }}
+      run: |
+        set -euo pipefail
+        # shellcheck source=.github/actions/release-input-validation.sh
+        source "${GITHUB_ACTION_PATH}/../release-input-validation.sh"
+        for pair in \
+          "registry:${INPUT_REGISTRY}" \
+          "ko_version:${INPUT_KO_VERSION}" \
+          "goreleaser_version:${INPUT_GORELEASER_VERSION}" \
+          "go_licenses_version:${INPUT_GO_LICENSES_VERSION}" \
+          "candidate_tag:${INPUT_CANDIDATE_TAG}"; do
+          reject_newline "${pair%%:*}" "${pair#*:}"
+        done
+        if [[ "${INPUT_REGISTRY}" != "ghcr.io" ]]; then
+          echo "::error::registry must be ghcr.io"
+          exit 1
+        fi
+        for version in "${INPUT_KO_VERSION}" "${INPUT_GORELEASER_VERSION}" "${INPUT_GO_LICENSES_VERSION}"; do
+          if [[ ! "${version}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::tool versions must use vMAJOR.MINOR.PATCH"
+            exit 1
+          fi
+        done
+        if [[ ! "${INPUT_CANDIDATE_TAG}" =~ ^candidate-[0-9]+-[0-9]+$ ]]; then
+          echo "::error::candidate_tag must match candidate-RUN_ID-RUN_ATTEMPT"
+          exit 1
+        fi
+        {
+          echo "registry=${INPUT_REGISTRY}"
+          echo "ko_version=${INPUT_KO_VERSION}"
+          echo "goreleaser_version=${INPUT_GORELEASER_VERSION}"
+          echo "go_licenses_version=${INPUT_GO_LICENSES_VERSION}"
+          echo "candidate_tag=${INPUT_CANDIDATE_TAG}"
+        } >> "$GITHUB_OUTPUT"
+
     - name: Setup build tools
       uses: ./.github/actions/setup-build-tools
       with:
         install_ko: 'true'
-        ko_version: ${{ inputs.ko_version }}
+        ko_version: ${{ steps.validate.outputs.ko_version }}
         install_syft: 'true'
         install_goreleaser: 'true'
-        goreleaser_version: ${{ inputs.goreleaser_version }}
+        goreleaser_version: ${{ steps.validate.outputs.goreleaser_version }}
 
     - name: Install go-licenses
       shell: bash
       env:
-        GO_LICENSES_VERSION: ${{ inputs.go_licenses_version }}
+        GO_LICENSES_VERSION: ${{ steps.validate.outputs.go_licenses_version }}
       run: |
         set -euo pipefail
         if [[ -z "${GO_LICENSES_VERSION}" ]]; then
@@ -73,19 +115,29 @@ runs:
     - name: Authenticate to registry
       uses: ./.github/actions/ghcr-login
       with:
-        registry: ${{ inputs.registry }}
+        registry: ${{ steps.validate.outputs.registry }}
 
     # Note: the Rekor v2 signing config (AICR_SIGNING_CONFIG) is fetched and
     # exported by the generate-slsa-predicate action, co-located with
     # SLSA_PREDICATE, so it is present here without a separate step. See #1650.
 
+    - name: Verify release target
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        RELEASE_TAG: ${{ github.ref_name }}
+        GITHUB_SHA: ${{ github.sha }}
+      run: |
+        set -euo pipefail
+        .github/scripts/release-images.sh release-target
+
     - name: Build and Release
       id: release
       shell: bash
       env:
         GITHUB_TOKEN: ${{ github.token }}
         GOFLAGS: -mod=vendor
-        HOMEBREW_DEPLOY_KEY: ${{ inputs.homebrew_deploy_key }}
+        AICR_CANDIDATE_TAG: ${{ steps.validate.outputs.candidate_tag }}
         # Repository paths are fully specified in .goreleaser.yaml kos.repositories
       run: |
         set -euo pipefail

.github/actions/release-input-validation.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.  All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+reject_newline() {
+  local name="$1" value="$2"
+  if [[ -z "${value}" || "${value}" == *$'\n'* || "${value}" == *$'\r'* ]]; then
+    echo "::error::${name} must be a non-empty single-line value"
+    exit 1
+  fi
+}
+
+require_release_image() {
+  case "$1" in
+    ghcr.io/nvidia/aicr | \
+      ghcr.io/nvidia/aicrd | \
+      ghcr.io/nvidia/aicr-validators/deployment | \
+      ghcr.io/nvidia/aicr-validators/performance | \
+      ghcr.io/nvidia/aicr-validators/conformance | \
+      ghcr.io/nvidia/aicr-validators/aiperf-bench | \
+      ghcr.io/nvidia/aicr-gate) ;;
+    *)
+      echo "::error::image_name is not a fixed AICR release image"
+      exit 1
+      ;;
+  esac
+}