chore: fixes from GPT-5.6 Sol high

Author: zhijie-yang

.github/actions/commit-releases-json/action.yaml

@@ -46,10 +46,20 @@ runs:
         git config user.email "${{ inputs.email }}"
         git config user.name "${{ inputs.actor }}"
 
-        git add oci/${{ inputs.image-name }}/_releases.json
-        if [[ -f oci/${{ inputs.image-name }}/_pro_releases.json ]]; then
-          git add oci/${{ inputs.image-name }}/_pro_releases.json
+        release_files=()
+        for release_file in _releases.json _pro_releases.json; do
+          path="oci/${{ inputs.image-name }}/${release_file}"
+          if [[ -f "$path" ]]; then
+            release_files+=("$path")
+          fi
+        done
+
+        if [[ ${#release_files[@]} -eq 0 ]]; then
+          echo "No release files found for ${{ inputs.image-name }}" >&2
+          exit 1
         fi
+
+        git add -- "${release_files[@]}"
         git commit -m "${{ inputs.message }}"
         
         for i in {1..10}; do

.github/actions/fetch-releases-json/copy-releases-files.sh

@@ -19,8 +19,10 @@ if [[ "$image_name" = "*" ]]; then
     find . -name "_releases.json" -exec cp --parents {} "$OLDPWD" \;
     find . -name "_pro_releases.json" -exec cp --parents {} "$OLDPWD" \;
     cd "$OLDPWD" || exit 1
-elif [[ -f "$directory/oci/$image_name/_releases.json" ]]; then
-    cp "$directory/oci/$image_name/_releases.json" "oci/$image_name/_releases.json"
+else
+    if [[ -f "$directory/oci/$image_name/_releases.json" ]]; then
+        cp "$directory/oci/$image_name/_releases.json" "oci/$image_name/_releases.json"
+    fi
     if [[ -f "$directory/oci/$image_name/_pro_releases.json" ]]; then
         cp "$directory/oci/$image_name/_pro_releases.json" "oci/$image_name/_pro_releases.json"
     fi

.github/workflows/Build-Rock.yaml

@@ -96,6 +96,7 @@ jobs:
       - name: Check Pro Build
         id: check-pro-build
         env:
+          ARTIFACT_PASSPHRASE: ${{ secrets.pro-artifact-passphrase }}
           UBUNTU_PRO_TOKEN: ${{ secrets.pro-token }}
           INPUTS_PRO_SERVICES: ${{ inputs.pro-services }}
         run: |
@@ -104,6 +105,10 @@ jobs:
               echo "Error: 'pro-token' must be provided in order to use 'pro-services'."
               exit 1
             fi
+            if [[ -z "${ARTIFACT_PASSPHRASE:-}" ]]; then
+              echo "Error: 'pro-artifact-passphrase' must be provided in order to use 'pro-services'."
+              exit 1
+            fi
             echo "pro-build=true" >> "$GITHUB_OUTPUT"
           else
             echo "pro-build=false" >> "$GITHUB_OUTPUT"

.github/workflows/Image.yaml

@@ -200,8 +200,8 @@ jobs:
       pro-services: ${{ matrix.pro-services }}
     secrets:
       source-github-token: ${{ secrets.ROCKSBOT_TOKEN }}
-      pro-token: ${{ secrets[matrix.pro-token] }}
-      pro-artifact-passphrase: ${{ secrets[matrix.pro-artifact-passphrase] }}
+      pro-token: ${{ secrets.ROCKS_PRO_TOKEN }}
+      pro-artifact-passphrase: ${{ secrets.ROCKS_PRO_ARTIFACT_PASSPHRASE }}
 
   test-rock:
     needs: [prepare-build, build-rock]
@@ -212,10 +212,11 @@ jobs:
     uses: ./.github/workflows/Test-Rock.yaml
     with:
       oci-archive-name: "${{ matrix.name }}_${{ matrix.commit }}_${{ matrix.dir_identifier }}"
+      encrypted-artifact: ${{ matrix.pro-services != '' }}
       trivyignore-path: ${{ matrix.ignored-vulnerabilities == '' && format('oci/{0}/.trivyignore', matrix.name) || '' }}
       ignored-vulnerabilities: ${{ matrix.ignored-vulnerabilities }}
     secrets:
-      pro-artifact-passphrase: ${{ secrets[matrix.pro-artifact-passphrase] }}
+      pro-artifact-passphrase: ${{ matrix.pro-services != '' && secrets.ROCKS_PRO_ARTIFACT_PASSPHRASE || '' }}
 
   prepare-upload:
     runs-on: self-hosted-linux-amd64-noble-private-endpoint-small
@@ -361,7 +362,7 @@ jobs:
         with:
           mode: decrypt
           input-path: ${{ env.OCI_ARCHIVE_NAME }}.gpg
-          passphrase: ${{ secrets[matrix.pro-artifact-passphrase] }}
+          passphrase: ${{ secrets.ROCKS_PRO_ARTIFACT_PASSPHRASE }}
           output-path: ${{ env.OCI_ARCHIVE_NAME }}
           preserve-original: false
 
@@ -380,11 +381,6 @@ jobs:
           MATRIX_REVISION: ${{ matrix.revision }}
           MATRIX_NAME: ${{ matrix.name }}
 
-      - uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7
-        with:
-          path: ${{ steps.rename-oci-archive.outputs.name }}
-          key: ${{ github.run_id }}-${{ steps.rename-oci-archive.outputs.name }}
-
       - name: Install Syft
         uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610
         with:
@@ -486,7 +482,8 @@ jobs:
           if [[ "$RUNNER_DEBUG" == "1" ]]; then
             set -x
           fi
-          echo "hashes=$(sha256sum ${VULN_REPORT} ${OCI_IMAGE_ARCHIVE} ${SBOMS} | base64 -w0)"
+          hashes=$(sha256sum "$VULN_REPORT" "$OCI_IMAGE_ARCHIVE" "$SBOMS" | base64 -w0)
+          echo "hashes=$hashes" >> "$GITHUB_OUTPUT"
 
       - name: Login to GHCR
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
@@ -509,7 +506,7 @@ jobs:
         with:
           mode: encrypt
           input-path: ${{ steps.rename-oci-archive.outputs.name }}
-          passphrase: ${{ secrets[matrix.pro-artifact-passphrase] }}
+          passphrase: ${{ secrets.ROCKS_PRO_ARTIFACT_PASSPHRASE }}
           output-path: ${{ steps.rename-oci-archive.outputs.name }}.gpg
 
       - name: Upload image
@@ -554,7 +551,8 @@ jobs:
             --arg digest "${STEPS_UPLOAD_IMAGE_OUTPUTS_DIGEST}" \
             --arg ignored_vulnerabilities "${MATRIX_IGNORED_VULNERABILITIES}" \
             --arg pro_services "${PRO_SERVICES}" \
-            '. + {base: $base, digest: $digest, "ignored-vulnerabilities": $ignored_vulnerabilities, "pro-services": $pro_services}' \
+            '. + {base: $base, digest: $digest, "ignored-vulnerabilities": $ignored_vulnerabilities}
+              | if $pro_services != "" then . + {"pro-services": $pro_services} else . end' \
             <<< '${{ toJSON(matrix) }}' > build_metadata.json
           ./src/uploads/upload_to_swift.sh \
             "${MATRIX_NAME}" \

.github/workflows/Release.yaml

@@ -83,8 +83,12 @@ jobs:
     runs-on: self-hosted-linux-amd64-noble-private-endpoint-small
     name: Release
     needs: [validate-push-release-request]
+    concurrency:
+      group: release-${{ inputs.oci-image-name }}
+      cancel-in-progress: false
     outputs:
-      gh-releases-matrix: ${{ steps.release-image.outputs.gh-releases-matrix }}
+      gh-releases-matrix: ${{ steps.release-image.outputs.gh-releases-matrix || '{"include":[]}' }}
+      has-github-releases: ${{ steps.release-image.outputs.has-github-releases }}
       is-public-release: ${{ steps.release-type.outputs.is-public-release }}
       is-pro-release: ${{ steps.release-type.outputs.is-pro-release }}
     env:
@@ -127,8 +131,19 @@ jobs:
           echo "is-pro-release=$is_pro_release" >> "$GITHUB_OUTPUT"
           is_public_release=$(cat is_public_release.txt)
           echo "is-public-release=$is_public_release" >> "$GITHUB_OUTPUT"
+          if [[ "$is_pro_release" == "true" && -z "${INPUTS_IMAGE_TRIGGER_CACHE_KEY}" ]]; then
+            log_error "Releasing an existing Pro revision is not supported. Use upload[*].release during the build instead."
+            exit 1
+          fi
+          # Error out if passphrase is not set for Pro release
+          if [[ "$is_pro_release" == "true" && -z "${ROCKS_PRO_ARTIFACT_PASSPHRASE}" ]]; then
+            log_error "ROCKS_PRO_ARTIFACT_PASSPHRASE is required for a Pro release."
+            exit 1
+          fi
         env:
+          INPUTS_IMAGE_TRIGGER_CACHE_KEY: ${{ inputs.image-trigger-cache-key }}
           INPUTS_OCI_IMAGE_NAME: ${{ inputs.oci-image-name }}
+          ROCKS_PRO_ARTIFACT_PASSPHRASE: ${{ secrets.ROCKS_PRO_ARTIFACT_PASSPHRASE }}
 
       # Download the image if `pro-release` is present and non-empty in the image trigger.
       # pattern should match <image_name>_<version>-<base>_*, e.g., mock-rock_1.2-22.04_*
@@ -139,7 +154,7 @@ jobs:
         env:
           INPUTS_OCI_IMAGE_NAME: ${{ inputs.oci-image-name }}
         with:
-          pattern: +([A-Za-z0-9-])_+([A-Za-z0-9.-])-[0-9][0-9].[0-9][0-9]_+([0-9])
+          pattern: ${{ inputs.oci-image-name }}_*
           merge-multiple: true
 
       # Decrypt the Pro image artifact being downloaded.
@@ -148,22 +163,28 @@ jobs:
       - name: Decrypt Pro image artifact
         id: decrypt-pro-image-artifact
         if: ${{ steps.release-type.outputs.is-pro-release == 'true' }}
+        env:
+          ARTIFACT_PASSPHRASE: ${{ secrets.ROCKS_PRO_ARTIFACT_PASSPHRASE }}
+          ARTIFACT_PATH: ${{ steps.download-image-artifact.outputs.download-path }}
         run: |
           set -e
           if [[ "$RUNNER_DEBUG" == "1" ]]; then
             set -x
           fi
           source src/shared/logs.sh
-          artifact_path="${{ steps.download-image-artifact.outputs.download-path }}"
-          for artifact in $artifact_path/*.gpg; do
-            if [ -f "$artifact" ]; then
-              log_info "Decrypting artifact: $artifact"
-              ./.github/actions/crypt-artifact/crypt-artifact.sh decrypt \
-                -i "$artifact" \
-                -p "${{ secrets.ROCKS_PRO_ARTIFACT_PASSPHRASE }}"
-            else
-              log_info "No .gpg artifacts found to decrypt."
-            fi
+
+          shopt -s nullglob
+          artifacts=("${ARTIFACT_PATH}"/*.gpg)
+          if [[ ${#artifacts[@]} -eq 0 ]]; then
+            log_error "No encrypted Pro artifacts were downloaded."
+            exit 1
+          fi
+
+          for artifact in "${artifacts[@]}"; do
+            log_info "Decrypting artifact: $artifact"
+            ./.github/actions/crypt-artifact/crypt-artifact.sh decrypt \
+              -i "$artifact" \
+              -p "$ARTIFACT_PASSPHRASE"
           done
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
@@ -191,6 +212,44 @@ jobs:
           IMAGE_NAME: ${{ inputs.oci-image-name }}
           SWIFT_CONTAINER_NAME: ${{ vars.SWIFT_CONTAINER_NAME }}
         run: ./src/image/get_canonical_tags_from_swift.sh
+
+      - name: Validate release requests
+        env:
+          ACR_CREDS_USR: ${{ env.IS_PROD == 'true' && secrets.ACR_CREDS_USR || secrets.ACR_CREDS_USR_DEV }}
+          ACR_CREDS_PSW: ${{ env.IS_PROD == 'true' && secrets.ACR_CREDS_PSW || secrets.ACR_CREDS_PSW_DEV }}
+          ACR_REGISTRY: ${{ env.IS_PROD == 'true' && 'ubuntu.azurecr.io' || secrets.ACR_REGISTRY_DEV }}
+          INPUTS_OCI_IMAGE_NAME: ${{ inputs.oci-image-name }}
+          IS_PRO_RELEASE: ${{ steps.release-type.outputs.is-pro-release }}
+          IS_PUBLIC_RELEASE: ${{ steps.release-type.outputs.is-public-release }}
+          PYTHONUNBUFFERED: 1
+          REVISION_TAGS_FILE: ${{ steps.get-all-canonical-tags.outputs.canonical-tags-file }}
+        run: |
+          set -e
+          source src/shared/logs.sh
+
+          if [[ "$IS_PRO_RELEASE" == "true" ]]; then
+            if [[ -z "${ACR_CREDS_USR:-}" || -z "${ACR_CREDS_PSW:-}" || -z "${ACR_REGISTRY:-}" ]]; then
+              log_error "ACR registry and credentials are required for a Pro release."
+              exit 1
+            fi
+            python3 -m src.image.release \
+              --image-trigger "oci/${INPUTS_OCI_IMAGE_NAME}/image.yaml" \
+              --image-name "$INPUTS_OCI_IMAGE_NAME" \
+              --all-releases "oci/${INPUTS_OCI_IMAGE_NAME}/_pro_releases.json" \
+              --all-revision-tags "$REVISION_TAGS_FILE" \
+              --pro \
+              --validate-only
+          fi
+
+          if [[ "$IS_PUBLIC_RELEASE" == "true" ]]; then
+            python3 -m src.image.release \
+              --image-trigger "oci/${INPUTS_OCI_IMAGE_NAME}/image.yaml" \
+              --image-name "$INPUTS_OCI_IMAGE_NAME" \
+              --all-releases "oci/${INPUTS_OCI_IMAGE_NAME}/_releases.json" \
+              --all-revision-tags "$REVISION_TAGS_FILE" \
+              --ghcr-repo "${{ github.repository_owner }}/oci-factory" \
+              --validate-only
+          fi
       
       # Pull the latest changes to prevent conflicts merging _releases.json
       - run: pushd ${{ env.RELEASE_REPO_DIR }} && git pull --quiet && popd
@@ -225,7 +284,6 @@ jobs:
           fi
           source src/shared/logs.sh
           log_info "Running in production? $([[ "$IS_PROD" == "true" ]] && echo YES || echo NO)"
-          
           python3 -m src.image.release \
             --image-trigger oci/${INPUTS_OCI_IMAGE_NAME}/image.yaml \
             --image-name ${INPUTS_OCI_IMAGE_NAME} \
@@ -251,11 +309,15 @@ jobs:
           fi
           source src/shared/logs.sh
           log_info "Running in production? $([[ "$IS_PROD" == "true" ]] && echo YES || echo NO)"
-          
+          if [[ -z "${ACR_CREDS_USR:-}" || -z "${ACR_CREDS_PSW:-}" || -z "${ACR_REGISTRY:-}" ]]; then
+            log_error "ACR registry and credentials are required for a Pro release."
+            exit 1
+          fi
+
           python3 -m src.image.release \
             --image-trigger oci/${INPUTS_OCI_IMAGE_NAME}/image.yaml \
             --image-name ${INPUTS_OCI_IMAGE_NAME} \
-            --all-releases oci/${INPUTS_OCI_IMAGE_NAME}/_releases.json \
+            --all-releases oci/${INPUTS_OCI_IMAGE_NAME}/_pro_releases.json \
             --all-revision-tags "${STEPS_GET_ALL_CANONICAL_TAGS_OUTPUTS_CANONICAL_TAGS_FILE}" \
             --pro
 
@@ -329,6 +391,7 @@ jobs:
     runs-on: ubuntu-22.04
     name: Github-Release
     needs: [do-releases]
+    if: ${{ needs.do-releases.outputs.has-github-releases == 'true' }}
     permissions:
       contents: write
     strategy:
@@ -343,7 +406,7 @@ jobs:
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
-          pattern: '*.sbom_preview.spdx.zip'
+          pattern: '${{ matrix.canonical-tag }}.sbom_preview.spdx.zip'
           path: sbom
 
       - name: Unzip SBOM artifacts