6c99372c52
Resolves issue where supply-chain-verify.yml ran before docker-build.yml completed, causing verification to skip on PRs because Docker image didn't exist yet. **Root Cause:** Both workflows triggered independently on PR events with no dependency, running concurrently instead of sequentially. **Solution:** Add workflow_run trigger to supply-chain-verify that waits for docker-build to complete successfully before running. **Changes:** - Remove pull_request trigger from supply-chain-verify.yml - Add workflow_run trigger for "Docker Build, Publish & Test" - Add job conditional checking workflow_run.conclusion == 'success' - Update tag determination to handle workflow_run context - Extract PR number from workflow_run metadata - Update PR comment logic for workflow_run events - Add debug logging for workflow_run context - Document workflow_run depth limitation **Behavior:** - PRs: docker-build → supply-chain-verify (sequential) - Push to main: docker-build → supply-chain-verify (sequential) - Failed builds: verification skipped (correct behavior) - Manual triggers: preserved via workflow_dispatch - Scheduled runs: preserved for weekly scans **Security:** - Workflow security validated: LOW risk - workflow_run runs in default branch context (prevents privilege escalation) - No secret exposure in logs or comments - Proper input sanitization for workflow metadata - YAML validation passed - Pre-commit hooks passed **Testing:** - YAML syntax validated - All references verified correct - Regression testing completed (no breaking changes) - Debug instrumentation added for validation **Documentation:** - Implementation summary created - QA report with security audit - Plan archived for reference - Testing guidelines provided Related: #461 (PR where issue was discovered) Resolves: Supply chain verification skipping on PRs Co-authored-by: GitHub Copilot <copilot@github.com>
78 lines
2.4 KiB
Markdown
78 lines
2.4 KiB
Markdown
# Current Specification
|
|
|
|
**Status**: Ready for Next Project
|
|
**Last Updated**: 2026-01-11
|
|
**Active Projects**: None
|
|
|
|
---
|
|
|
|
## Active Projects
|
|
|
|
No active projects at this time. See "Recently Completed" below for the most recent work.
|
|
|
|
|
|
|
|
|
|
|
|
---
|
|
|
|
## Recently Completed
|
|
|
|
### Workflow Orchestration Fix (2026-01-11)
|
|
|
|
Successfully fixed workflow orchestration issue where supply-chain-verify was running before docker-build completed, causing verification to skip on PRs.
|
|
|
|
**Documentation**:
|
|
- **Implementation Summary**: [docs/implementation/WORKFLOW_ORCHESTRATION_FIX.md](../implementation/WORKFLOW_ORCHESTRATION_FIX.md)
|
|
- **QA Report**: [docs/reports/qa_report_workflow_orchestration.md](../reports/qa_report_workflow_orchestration.md)
|
|
- **Archived Plan**: [docs/plans/archive/workflow_orchestration_fix_2026-01-11.md](archive/workflow_orchestration_fix_2026-01-11.md)
|
|
|
|
**Status**: ✅ Complete - Deployed to production
|
|
|
|
---
|
|
|
|
### Grype SBOM Remediation (2026-01-10)
|
|
|
|
Successfully resolved CI/CD failures in the Supply Chain Verification workflow caused by Grype SBOM format mismatch.
|
|
|
|
**Documentation**:
|
|
- **Implementation Summary**: [docs/implementation/GRYPE_SBOM_REMEDIATION.md](../implementation/GRYPE_SBOM_REMEDIATION.md)
|
|
- **QA Report**: [docs/reports/qa_report.md](../reports/qa_report.md)
|
|
- **Archived Plan**: [docs/plans/archive/grype_sbom_remediation_2026-01-10.md](archive/grype_sbom_remediation_2026-01-10.md)
|
|
|
|
**Status**: ✅ Complete - Deployed to production
|
|
|
|
---
|
|
|
|
## Guidelines for Creating New Specs
|
|
|
|
When starting a new project, create a detailed specification in this file following the [Spec-Driven Workflow v1](.github/instructions/spec-driven-workflow-v1.instructions.md) format.
|
|
|
|
### Required Sections
|
|
|
|
1. **Problem Statement** - What issue are we solving?
|
|
2. **Root Cause Analysis** - Why does the problem exist?
|
|
3. **Solution Design** - How will we solve it?
|
|
4. **Implementation Plan** - Step-by-step tasks
|
|
5. **Testing Strategy** - How will we validate success?
|
|
6. **Success Criteria** - What defines "done"?
|
|
|
|
### Archiving Completed Specs
|
|
|
|
When a specification is complete:
|
|
|
|
1. Create implementation summary in `docs/implementation/`
|
|
2. Move spec to `docs/plans/archive/` with timestamp
|
|
3. Update this file with completion notice
|
|
|
|
---
|
|
|
|
## Archive Location
|
|
|
|
Completed and archived specifications can be found in:
|
|
- [docs/plans/archive/](archive/)
|
|
|
|
---
|
|
|
|
**Note**: This file should only contain ONE active specification at a time. Archive completed work before starting new projects.
|