open-platform/app-template
Template
3
0
Fork 0
Code Issues Pull requests Releases 5 Packages 2 Wiki Activity Actions

POL-3: cosign signing conditional — a fresh platform ships apps first-try #6

Merged
plat merged 1 commit from feat/pol-3-cosign-conditional into main 2026-07-01 23:32:32 +00:00
Conversation 0 Commits 1 Files changed 2 +20 -3
plat commented 2026-07-01 22:38:07 +00:00
Owner
Copy link

The POL-3 cosign sign step in release.yml + preview.yml was mandatory, but a freshly germinated platform seals only REGISTRY_TOKEN (not COSIGN_PRIVATE_KEY/COSIGN_PASSWORD), so signing failed and blocked the release/preview build — no app shipped first-try.

verify-image-provenance is Audit-first (POL-0 Decision 3): unsigned images are reported in a PolicyReport, never blocked at admission. So this makes signing CONDITIONAL: when COSIGN_PRIVATE_KEY is unset/empty the step logs cosign key not provisioned; skipping signing and continues; when the operator provisions the platform cosign key (cosign-signing-key.yaml + Forgejo Actions secrets) it signs as before — no workflow edit needed to turn it on.

Part of the wb-gate capstone release (paired with plat/mitosis#61: germinate CIBTAG 0.2.0 + derive, and lean-trim keeps kyverno/kyverno-policies/letsencrypt/cosign-signing). Validated live on a fresh germination: app builds on ci-builder:0.2.0, cosign step skips gracefully, app ships to a running prod pod (HTTP 200).

Do not merge until the GATE owner merges the release set.

The POL-3 `cosign sign` step in release.yml + preview.yml was mandatory, but a freshly germinated platform seals only REGISTRY_TOKEN (not COSIGN_PRIVATE_KEY/COSIGN_PASSWORD), so signing failed and blocked the release/preview build — no app shipped first-try. verify-image-provenance is Audit-first (POL-0 Decision 3): unsigned images are reported in a PolicyReport, never blocked at admission. So this makes signing CONDITIONAL: when COSIGN_PRIVATE_KEY is unset/empty the step logs `cosign key not provisioned; skipping signing` and continues; when the operator provisions the platform cosign key (cosign-signing-key.yaml + Forgejo Actions secrets) it signs as before — no workflow edit needed to turn it on. Part of the wb-gate capstone release (paired with plat/mitosis#61: germinate CIBTAG 0.2.0 + derive, and lean-trim keeps kyverno/kyverno-policies/letsencrypt/cosign-signing). Validated live on a fresh germination: app builds on ci-builder:0.2.0, cosign step skips gracefully, app ships to a running prod pod (HTTP 200). Do not merge until the GATE owner merges the release set.
POL-3: skip cosign signing gracefully when no key is provisioned
Some checks failed
check / check (push) Successful in 1m47s
Details
check / check (pull_request) Successful in 1m33s
Details
preview / preview (pull_request) Failing after 1s
Details
86d7e3624a 
A freshly germinated platform seals REGISTRY_TOKEN but not COSIGN_PRIVATE_KEY,
so the mandatory 'cosign sign' step failed and blocked the release/preview
build -> no app shipped first-try. verify-image-provenance is Audit-first
(POL-0 Decision 3): unsigned images are reported, never blocked. So skip
signing gracefully when COSIGN_PRIVATE_KEY is unset/empty; provision the
platform cosign key to enable it (no workflow edit needed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
plat merged commit 6827d1add3 into main 2026-07-01 23:32:32 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-work
Queue this for an agent: it will build it and open a PR

  
agent-working
An agent is actively working on this

  
ultracode
Operators: run a Fable ultracode orchestrator on this issue

No labels
agent-work
agent-working
ultracode
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
open-platform/app-template!6
No description provided.