feat(release): attest the Docker image and PyPI launcher - #430
Merged
Conversation
Closes the remaining gap in the release-signing story: previously only the npm tarballs carried attestations. Docker: the build-push step now captures the image digest and a new step attests it with actions/attest-build-provenance (same pinned action and composite-action-in-normal-job approach as the existing provenance job), pushing the attestation to the registry. Verify with: gh attestation verify oci://index.docker.io/debugmcp/mcp-debugger:<tag> --repo debugmcp/mcp-debugger. PyPI: the launcher migrates from twine+token to trusted publishing via pypa/gh-action-pypi-publish (id-token: write), which generates and uploads PEP 740 attestations automatically. twine remains for the metadata check only. The validate-pypi secrets job, the release checklist's token item, and release-dry-run's PYPI_TOKEN check are retired accordingly. Docs: SUPPLY-CHAIN-SECURITY.md's "Verifying a Release" now covers all three artifact types, and the release-notes template gains the Docker verify command and a PyPI attestation pointer. Requires (before the next tag): a trusted publisher for debug-mcp-server-launcher on pypi.org (owner debugmcp, repo mcp-debugger, workflow release.yml, environment blank). PYPI_TOKEN can be deleted after the first successful OIDC publish. Fixes #422 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #422
What
Every distributed artifact becomes independently verifiable back to the tagged commit and workflow — previously only the npm tarballs were attested (
SUPPLY-CHAIN-SECURITY.mdcalled this gap out explicitly). Closes the remaining OpenSSF Best Practicessigned_releasesgap.Docker (
docker-publish)docker/build-push-actionstep gets anidso the pushed image digest is captured.actions/attest-build-provenance(subject-name: index.docker.io/debugmcp/mcp-debugger,push-to-registry: true) — the same pinned action and composite-action-in-a-normal-job approach as the existingprovenancejob (slsa-github-generator's reusable workflows remain unusable in this org; see the comment in release.yml).id-token: write+attestations: write.provenance:/sbom:on build-push-action — that rewrites the pushed index with attestation manifests and can confuse older clients; the digest attestation alone closes the gap.Verification:
gh attestation verify oci://index.docker.io/debugmcp/mcp-debugger:<tag> --repo debugmcp/mcp-debuggerPyPI (
pypi-publish)PYPI_TOKENto trusted publishing via SHA-pinnedpypa/gh-action-pypi-publish(v1.14.2) withid-token: write— mirroring the npm OIDC setup. The action generates and uploads PEP 740 attestations automatically.twine checkstays as a metadata lint; thevalidate-pypijob in validate-secrets.yml, the release checklist's token item, andrelease-dry-run.sh'sPYPI_TOKENcheck are retired.Docs
SUPPLY-CHAIN-SECURITY.md: "Verifying a Release" now covers all three artifact types (with the "do not yet carry their own attestations" caveat removed), PyPI/Docker publishing sections updated, access-continuity table updated.debug-mcp-server-launcher: pypi.org → project → Settings → Publishing → Add GitHub publisher with ownerdebugmcp, repositorymcp-debugger, workflowrelease.yml, environment blank. Without this, the PyPI publish fails (invalid-publisher).PYPI_TOKENsecret (same dance as the npm OIDC rollout).Both attestations prove out live at the v0.25.0 tag push — flagged on the release-execution ticket.
🤖 Generated with Claude Code