OSS Image Compliance Pipeline
Designed a GitHub Actions-first supply-chain pipeline that mirrors upstream container images to GHCR, scans them, and attaches standards-based compliance evidence to immutable digests.
6 evidence types • Digest-bound attestations • Automated image intake
The Challenge
Consuming upstream open-source container images introduces provenance, vulnerability, and compliance questions. Tags can move, scan results become detached from the artifact, and reviewers lack a consistent evidence package for release decisions.
The Solution
Designed a GitHub Actions-first workflow that ingests an upstream image, mirrors it into GitHub Container Registry, scans the mirrored artifact, and publishes SBOM, VEX, vulnerability, provenance, STIG, and FIPS evidence against its immutable digest.
Architecture
Implementation Process
Resolved the upstream image to an immutable digest before promotion
Mirrored the selected artifact into GHCR under a controlled namespace
Ran security and compliance stages to generate machine-readable evidence
Attached attestations to the digest so evidence travels with the exact reviewed artifact
Results & Impact
Created a reproducible intake path for upstream open-source images
Bound compliance evidence to immutable image digests rather than mutable tags
Standardized six evidence categories: SBOM, VEX, vulnerability, provenance, STIG, and FIPS
Made supply-chain review artifacts discoverable alongside the mirrored image