2. Image and Supply Chain

Your code is a small part of what runs in production: the image also contains a Linux distribution, a JRE and around a hundred libraries. Supply-chain security asks three questions about every image before it runs: what is inside it? (an SBOM), does it contain known vulnerabilities? (a scan), and was it really built by our pipeline, from this commit? (provenance). The image job of ci.yaml answers the three, in this order:

flowchart LR
    build["build (load locally)"] --> sarif["Trivy report -> Security tab"]
    sarif --> gate{"Trivy gate: fixable CRITICAL?"}
    gate -->|yes| fail[job fails, nothing published]
    gate -->|no| sbom["SBOM (Syft, SPDX)"]
    sbom --> push["push to ghcr.io (sha-<commit>, main)"]
    push --> prov["attest provenance (Sigstore)"]
    prov --> attsbom["attest SBOM"]

The job is in .github/workflows/ci.yaml (shown in full in step 1); this page explains its steps.

Build, then scan, then push

Scanning before pushing means a vulnerable image is never published. The gate is deliberately narrow: failing on every HIGH without a fix would block all work for problems nobody can solve today, and teams learn to ignore a gate that is always red. The full report still lists them.

Keep dependencies moving

# Lab 11: keep dependencies and pinned actions up to date with reviewed pull requests.
version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
  - package-ecosystem: maven
    directories: ["/services/*"]
    schedule:
      interval: weekly
  - package-ecosystem: docker
    directories: ["/services/*"]
    schedule:
      interval: weekly

Dependabot opens a pull request when a pinned action, a Maven dependency or a base image has a new version; your CI then tests the upgrade like any other change.

See it work

After a push to main, open Actions → CI → image (catalog). You should see every step green and, at the end, two attestation links. Then:

• Packages (your profile or repository page): boxoffice-catalog with the tags main and sha-…. New packages are private; for the local cluster of step 4 either make it public (package → Package settings → Change visibility) or create a pull secret (step 4 shows how).
• Security → Code scanning: the Trivy findings, one alert per vulnerability.

• Verify the provenance from your machine with the GitHub CLI:

  gh attestation verify oci://ghcr.io/<your-user>/boxoffice-catalog:main --owner <your-user>
  

  You should see ✓ Verification succeeded! and the workflow, commit and runner that built the image. Any change to the image — even one byte — changes its digest and the verification fails.

Next: Performance gate