.github/workflows/build.yml (1)

531-561: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Sign step can run with empty image-refs when all digest resolution fails.

The sign step's guard was relaxed to just inputs.enable_cosign_sign (line 570), but steps.cosign-refs.outputs.refs can be empty precisely in the new skip-mode path this PR adds: if docker buildx imagetools inspect fails or returns no digest for every enabled registry, DOCKERHUB_FINAL/GHCR_FINAL are both empty, REFS stays "", and the sign step still invokes the cosign-sign composite. That composite documents image-refs as a required input with no default, per its README: .Manifest: provides the manifest or manifest list confirms the digest-extraction approach is sound, but the composite's contract states image-refs | Newline-separated fully qualified image references to sign (e.g., docker.io/org/app@sha256:abc...) | Yes | — — no defined behavior for an empty value. Before this change, the sign step only ran after a successful build, so refs was always non-empty; now the exact "recover from a transient failure" scenario this PR targets can also be the one where the sign step fires with nothing to sign, likely hard-failing the job (continue_gitops_on_signing_failure defaults false) even though the earlier per-registry ::warning:: messages already explained why no digest was found.

Guard the sign step against an empty refs list; the existing per-registry warnings already cover user-facing diagnostics for that case.

🔧 Proposed fix

       - name: Sign container images with cosign
-        if: inputs.enable_cosign_sign
+        if: inputs.enable_cosign_sign && steps.cosign-refs.outputs.refs != ''
         id: cosign-sign

Also applies to: 569-578

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build.yml around lines 531 - 561, Update the cosign sign
step guard near the cosign-refs output so it runs only when
inputs.enable_cosign_sign is enabled and steps.cosign-refs.outputs.refs is
non-empty. Preserve the existing signing behavior when valid image references
are produced, while skipping the composite action when digest resolution leaves
refs empty.

.github/workflows/build.yml (2)

609-636: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Make the signing summary reflect the actual continuation state.

When continue_gitops_on_signing_failure is false, the report still runs but subsequent GitOps artifact steps are skipped. The summary nevertheless says upload was allowed to continue. It also claims the images are already present even when a registry lookup failed. Branch the summary on the continuation input and only claim presence for registries with verified refs.

Proposed fix

         env:
           REFS: ${{ steps.cosign-refs.outputs.refs }}
           APP_NAME: ${{ matrix.app.name }}
           SIGNING_FAILED: ${{ steps.cosign-sign.outcome == 'failure' }}
           HAS_LOOKUP_ERROR: ${{ steps.cosign-refs.outputs.has_lookup_error }}
+          CONTINUE_ON_SIGNING_FAILURE: ${{ inputs.continue_gitops_on_signing_failure || false }}

...
-            echo "GitOps artifact upload was allowed to continue (\`continue_gitops_on_signing_failure: true\`)."
-            echo "The image(s) above are immutable and already present in the registry, but signing did not complete for every one — some may already be signed, others may not be."
+            if [ "$CONTINUE_ON_SIGNING_FAILURE" == "true" ]; then
+              echo "GitOps artifact upload was allowed to continue (\`continue_gitops_on_signing_failure: true\`)."
+            else
+              echo "GitOps artifact upload was not allowed to continue; subsequent artifact steps may have been skipped."
+            fi
+            echo "For registries with verified refs, the image is immutable but signing did not complete for every one — some may already be signed, others may not be."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build.yml around lines 609 - 636, Update the signing
failure summary block around SIGNING_FAILED and HAS_LOOKUP_ERROR to branch on
continue_gitops_on_signing_failure, stating that GitOps artifact upload was
skipped when false and allowed to continue only when true. Revise the
image-presence statement so it claims images are already present only for
registries with successfully verified refs, while explicitly excluding any
registry affected by a lookup error.

---

514-526: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Treat manifest parsing failures as lookup failures.

Because set -e is not enabled, a failed jq pipeline leaves digest empty but keeps failed=false. The workflow can then omit that registry and report successful signing for the remaining refs. Check the parser exit status and set failed=true when the inspect output is invalid.

Proposed fix

           if out=$(docker buildx imagetools inspect "$ref" --format '{{json .Manifest}}' 2>"$err_file"); then
-            digest=$(echo "$out" | jq -r '.digest // empty')
-            [ -z "$digest" ] && echo "::warning::docker buildx imagetools inspect for ${ref} returned no digest — cosign will skip this registry." >&2
+            if ! digest=$(printf '%s' "$out" | jq -r '.digest // empty'); then
+              failed="true"
+              echo "::warning::Failed to parse manifest output for ${ref} — cosign will skip this registry." >&2
+            elif [ -z "$digest" ]; then
+              echo "::warning::docker buildx imagetools inspect for ${ref} returned no digest — cosign will skip this registry." >&2
+            fi

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build.yml around lines 514 - 526, Update resolve_digest so
jq parsing failures are detected and set failed=true, treating invalid inspect
output as a registry lookup failure. Check the parser exit status while
extracting digest, preserve the existing no-digest warning for successful
parsing with an empty digest, and route parsing errors through the existing
failure warning and cosign-skip behavior.