Repository navigation
Use a shared GHCR image for wolfCOSE Linux CI - #92
Merged
Merged
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The publishing workflow and mutable image references introduce unresolved CI supply-chain risks.
3 open findings
What changed in this PR
Migrates Linux CI to a shared GHCR image while retaining native macOS execution.
Changes:
- Adds image build, publication, and smoke validation.
- Moves Linux workflows to the shared container and isolates caches.
- Adapts workspace trust and release paths for containers.
| File | Description |
|---|---|
.github/docker/wolfcose-ci/Dockerfile |
Defines the CI image. |
.github/docker/wolfcose-ci/Dockerfile.dockerignore |
Restricts build context. |
.github/docker/wolfcose-ci/README.md |
Documents image maintenance. |
.github/docker/wolfcose-ci/smoke-test.sh |
Validates installed tools. |
.github/workflows/_resolve-wolfssl.yml |
Containerizes version resolution. |
.github/workflows/build-test.yml |
Containerizes Linux builds. |
.github/workflows/c99-compliance.yml |
Containerizes C99 checks. |
.github/workflows/cmdline-test.yml |
Containerizes CLI tests. |
.github/workflows/codeql.yml |
Containerizes CodeQL analysis. |
.github/workflows/codespell.yml |
Runs packaged Codespell. |
.github/workflows/comprehensive-tests.yml |
Containerizes algorithm tests. |
.github/workflows/cose-hpke.yml |
Containerizes HPKE tests. |
.github/workflows/coverage.yml |
Containerizes coverage collection. |
.github/workflows/coverity.yml |
Containerizes Coverity analysis. |
.github/workflows/empty-brace-scan.yml |
Containerizes scope scanning. |
.github/workflows/examples.yml |
Containerizes example builds. |
.github/workflows/house-style.yml |
Containerizes style checks. |
.github/workflows/interop.yml |
Provides packaged interop toolchains. |
.github/workflows/lean-build.yml |
Containerizes lean configurations. |
.github/workflows/minimal-build.yml |
Containerizes minimal builds. |
.github/workflows/misra-2012.yml |
Uses packaged Cppcheck. |
.github/workflows/misra-2023.yml |
Containerizes MISRA checks. |
.github/workflows/multi-compiler.yml |
Uses packaged compiler matrix. |
.github/workflows/nightly.yml |
Containerizes nightly dispatch. |
.github/workflows/publish-ci-image.yml |
Publishes and validates the image. |
.github/workflows/release-prep.yml |
Containerizes release qualification. |
.github/workflows/sanitizer.yml |
Containerizes sanitizer tests. |
.github/workflows/scenarios.yml |
Containerizes scenario tests. |
.github/workflows/semgrep.yml |
Runs packaged Semgrep. |
.github/workflows/stack-bounds.yml |
Containerizes stack checks. |
.github/workflows/static-analysis.yml |
Uses packaged analyzers. |
.github/workflows/wiki-sync.yml |
Containerizes wiki publication. |
.github/workflows/wolfssl-versions.yml |
Containerizes compatibility tests. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
mattia-moffa
approved these changes
Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ghcr.io/wolfssl/wolfcose-ci:latest; anonymous pulling verified.apt-getinstalls. Kept native macOS.