Repository navigation
Conversation
… receipt Product release workflows cannot list every fork their build consumes by hand: kine reaches loft-enterprise as an image, loft-sh/kubernetes as a release binary and a source clone, and vnode-internal as a Go replace. A list kept by hand drifts, and the design (loft-sh/architecture fork-review-check.md, build step 4) asks the check to fail any fork reference no resolver understands, so a new form cannot slip past review. scan walks go.mod, go.work, Dockerfiles, shell scripts, Makefiles, goreleaser files and workflows, resolves each fork reference through the existing go, image and ref paths, and fails references it cannot pin. A templated reference passes only when the caller names that fork with the matching explicit flag. Non-fork loft-sh repos and image names with no repo behind them are ignored. The composite action and the workflow_call wrapper give release workflows one step that writes the JSON receipt to attach to the release. The action script keeps the CLI exit code but still publishes the receipt and pass outputs on a rule failure, so an advisory caller can read them. Builds on 7ac5cbc and c9cb3fc. Claude-Session: https://claude.ai/code/session_017edg9gFKBwMnmsAVXxEJzn
…repository scan treated any ghcr.io/loft-sh image whose name matched no repository as not a fork and skipped it. kine-fips is such an image: today loft-sh/fips-builds builds it from upstream rancher/kine, so skipping it was right by luck. A fork that published an image under another name would have passed with no review evidence, a hole in the fail-closed net the design promises auditors. The scan now asks GitHub which repository the container package is linked to. A non-fork build repository is still ignored; a fork publishing under another name fails, and so does a package the token cannot read, because the image could carry fork code. The job needs packages: read for that lookup. Claude-Session: https://claude.ai/code/session_017edg9gFKBwMnmsAVXxEJzn
Builds can consume vendored Go code that differs from the module graph. Apply the base branch verification to scan-discovered modules as well as explicit Go directories, and let action callers provide the trusted verifier.
vcauesantos
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Build step 4 of the fork review check design: a
scanmode that finds every fork a product build consumes, plus the composite action and reusable workflow a product release calls to write the JSON receipt it attaches. Stacked on #338 (image and binary modes), which is stacked on #337 (the CLI).Key Changes
scanmode walksgo.mod,go.work, Dockerfiles, shell scripts, Makefiles,.goreleaserfiles and workflows below-root. Eachgithub.com/loft-sh/<fork>orghcr.io/loft-sh/<fork>reference resolves through the existing paths: Go module graph, digest-pinned image (withARGdefaults substituted),git clone -bor a workflowrepository:checkout as a source pin, release download as a binary.file:line. A templated reference (a variable with no default in the file) passes only when the caller names that fork with-image,-url/-sha256or the new-source fork=ref. Non-fork loft-sh repos are ignored. An image whose name matches no repo (ghcr.io/loft-sh/kine-fips) is traced to the repo GitHub links its package to: a non-fork build repo (loft-sh/fips-builds, which builds kine-fips from upstreamrancher/kine) is ignored, a fork publishing under another name fails, and an unreadable package fails. Jobs needpackages: read. Links (/blob/,/pull/,/releases/tag/, ...) are ignored.check()now shares per-form resolvers between the modes; existing tests pass unchanged.fork-review-check(default modescan, advisory by default). All logic sits insrc/action.sh, which passes the CLI exit code through but still writesreceiptandpassoutputs on a rule failure. bats suite added and wired into the test workflow.fork-review-check.yaml: checkout, the action atfork-review-check/v1, upload the receipt artifact. The token is an optionalsecrets: github-token, defaulting to the workflow token.live-scanjob (advisory,continue-on-error) runs scan against public loft-sh/kubernetes.Dependencies
fork-review-check/v1tag, which is cut after merge.TODO
fork-review-check/v1References DEVOPS-1740
https://claude.ai/code/session_017edg9gFKBwMnmsAVXxEJzn