From f1b12c39f977ee13f03aa4cd606dd721cd75070f Mon Sep 17 00:00:00 2001 From: Toddy Mladenov Date: Thu, 2 Jul 2026 08:39:50 -0700 Subject: [PATCH 1/2] build: add security-policy and vulnerability-reporting annotations (#134) --- .github/workflows/build-cssc-dashboard.yml | 2 ++ docs/guides/build/reading-image-annotations.md | 2 ++ docs/reference/image-annotations.md | 2 ++ 3 files changed, 6 insertions(+) diff --git a/.github/workflows/build-cssc-dashboard.yml b/.github/workflows/build-cssc-dashboard.yml index e5a6167..e46a957 100644 --- a/.github/workflows/build-cssc-dashboard.yml +++ b/.github/workflows/build-cssc-dashboard.yml @@ -163,6 +163,8 @@ jobs: "com.toddysm.image.tags=${major}|${minor}|${patch}|${build}" "com.toddysm.build.workflow=${WORKFLOW}" "com.toddysm.build.run-url=${SERVER_URL}/${REPO}/actions/runs/${RUN_ID}" + "com.toddysm.security.policy=${SERVER_URL}/${REPO}?tab=security-ov-file" + "com.toddysm.security.reporturl=${SERVER_URL}/${REPO}/security/advisories/new" ) ann_args=() diff --git a/docs/guides/build/reading-image-annotations.md b/docs/guides/build/reading-image-annotations.md index 3bc7d77..100e6ef 100644 --- a/docs/guides/build/reading-image-annotations.md +++ b/docs/guides/build/reading-image-annotations.md @@ -139,6 +139,8 @@ architecture. | `com.toddysm.image.tags` | Every tag applied to the image, `\|`-separated (e.g. `0\|0.1\|0.1.0\|0.1.0-69deeec`) | The full tag set the build published, from most-moving (`major`) to immutable (`build`); recover every tag from the image itself. | | `com.toddysm.build.workflow` | Building workflow display name | Which workflow produced the image; auditing the build path. | | `com.toddysm.build.run-url` | Link to the exact GitHub Actions run | Jump straight to the CI run that built the image for logs and provenance. | +| `com.toddysm.security.policy` | Link to the repository security policy | Find out how vulnerabilities in the image are handled and disclosed. | +| `com.toddysm.security.reporturl` | URL for reporting a vulnerability | Report a vulnerability programmatically (the GitHub private advisory intake). | ## Worked examples diff --git a/docs/reference/image-annotations.md b/docs/reference/image-annotations.md index 1f47cfa..b8d9cd3 100644 --- a/docs/reference/image-annotations.md +++ b/docs/reference/image-annotations.md @@ -49,6 +49,8 @@ crane manifest ghcr.io/toddysm/apps/cssc-dashboard/packages-service:0.1 | jq .an | `com.toddysm.image.tags` | Every tag applied to the image, `\|`-separated, from `major` to `build` (e.g. `0\|0.1\|0.1.0\|0.1.0-69deeec`). | | `com.toddysm.build.workflow` | The building workflow display name. | | `com.toddysm.build.run-url` | Link to the exact GitHub Actions run. | +| `com.toddysm.security.policy` | Link to the repository security policy (how vulnerabilities are handled). | +| `com.toddysm.security.reporturl` | URL for reporting a vulnerability programmatically (the GitHub private advisory intake). | ## Reproducibility From f8092df07f2da461582b1a0e0da60f86413f8989 Mon Sep 17 00:00:00 2001 From: Toddy Mladenov Date: Thu, 2 Jul 2026 09:12:49 -0700 Subject: [PATCH 2/2] build: rename vulnerability-reporting annotation to com.toddysm.security.report-url --- .github/workflows/build-cssc-dashboard.yml | 2 +- docs/guides/build/reading-image-annotations.md | 2 +- docs/reference/image-annotations.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-cssc-dashboard.yml b/.github/workflows/build-cssc-dashboard.yml index e46a957..d1646a3 100644 --- a/.github/workflows/build-cssc-dashboard.yml +++ b/.github/workflows/build-cssc-dashboard.yml @@ -164,7 +164,7 @@ jobs: "com.toddysm.build.workflow=${WORKFLOW}" "com.toddysm.build.run-url=${SERVER_URL}/${REPO}/actions/runs/${RUN_ID}" "com.toddysm.security.policy=${SERVER_URL}/${REPO}?tab=security-ov-file" - "com.toddysm.security.reporturl=${SERVER_URL}/${REPO}/security/advisories/new" + "com.toddysm.security.report-url=${SERVER_URL}/${REPO}/security/advisories/new" ) ann_args=() diff --git a/docs/guides/build/reading-image-annotations.md b/docs/guides/build/reading-image-annotations.md index 100e6ef..d5ad61e 100644 --- a/docs/guides/build/reading-image-annotations.md +++ b/docs/guides/build/reading-image-annotations.md @@ -140,7 +140,7 @@ architecture. | `com.toddysm.build.workflow` | Building workflow display name | Which workflow produced the image; auditing the build path. | | `com.toddysm.build.run-url` | Link to the exact GitHub Actions run | Jump straight to the CI run that built the image for logs and provenance. | | `com.toddysm.security.policy` | Link to the repository security policy | Find out how vulnerabilities in the image are handled and disclosed. | -| `com.toddysm.security.reporturl` | URL for reporting a vulnerability | Report a vulnerability programmatically (the GitHub private advisory intake). | +| `com.toddysm.security.report-url` | URL for reporting a vulnerability | Report a vulnerability programmatically (the GitHub private advisory intake). | ## Worked examples diff --git a/docs/reference/image-annotations.md b/docs/reference/image-annotations.md index b8d9cd3..3c8793f 100644 --- a/docs/reference/image-annotations.md +++ b/docs/reference/image-annotations.md @@ -50,7 +50,7 @@ crane manifest ghcr.io/toddysm/apps/cssc-dashboard/packages-service:0.1 | jq .an | `com.toddysm.build.workflow` | The building workflow display name. | | `com.toddysm.build.run-url` | Link to the exact GitHub Actions run. | | `com.toddysm.security.policy` | Link to the repository security policy (how vulnerabilities are handled). | -| `com.toddysm.security.reporturl` | URL for reporting a vulnerability programmatically (the GitHub private advisory intake). | +| `com.toddysm.security.report-url` | URL for reporting a vulnerability programmatically (the GitHub private advisory intake). | ## Reproducibility