wizcli tag: scaffolding for code-to-cloud correlation (WIP) - #750
Open
bschwedler wants to merge 3 commits into
Open
wizcli tag: scaffolding for code-to-cloud correlation (WIP)#750bschwedler wants to merge 3 commits into
bschwedler wants to merge 3 commits into
Conversation
Test Results2 211 tests ±0 2 210 ✅ - 1 6m 52s ⏱️ - 1m 16s For more details on these failures, see this check. Results for commit b1d9ea1. ± Comparison against base commit dd9d958. ♻️ This comment has been updated with latest results. |
bschwedler
force-pushed
the
feat/wizcli-security-scan
branch
3 times, most recently
from
August 14, 2026 16:22
da0cb96 to
e2f354b
Compare
bschwedler
marked this pull request as ready for review
August 18, 2026 13:48
Adds a 'bakery wizcli tag' CLI subcommand and a Tag step in the merge
job of bakery-build-native.yml.
For each matched image target, calls 'wizcli tag' with the pinned
{Version}-{OS}-{Variant} registry tag (e.g.
ghcr.io/posit-dev/package-manager:2026.07.0-ubuntu-24.04-std), linking
build-time scan results to the published image in Wiz's inventory.
Only runs on real production pushes (inputs.push && dev-versions !=
only && wiz-auth). Dev builds are excluded since their scans are against
temp ECR digests that don't map to stable published tags.
continue-on-error: true so a tagging failure never blocks a release.
Per Wiz documentation, multi-platform images must be tagged by each
platform's child digest (repo@sha256:PLATFORM_DIGEST), not the
manifest list digest. The per-platform digest is content-addressed
and identical in both the temp ECR registry (where it was scanned)
and the final published registry (GHCR/Docker Hub), so Wiz correctly
correlates build scan findings to the published image.
bakery wizcli tag now:
- Accepts metadata JSON files as positional arguments
- Reads containerimage.digest from each file
- Maps the image name to its final published registry repos via config
- Calls wizcli tag {final-repo}@{digest} for each registry x platform
The workflow Tag step passes ./*-metadata.json (all platform metadata
files downloaded in the merge job) as arguments.
'bakery wizcli tag' called BakeryConfig.from_path(), which doesn't exist anywhere on BakeryConfig -- every other command (including 'wizcli scan') uses BakeryConfig.from_context(). The tag command raised AttributeError on every invocation; continue-on-error: true in the Tag workflow step masked this as a silent no-op instead of a visible failure. No test previously covered the tag command at all.
bschwedler
force-pushed
the
feat/wizcli-tag
branch
from
August 18, 2026 14:27
04013e6 to
b1d9ea1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
bakery wizcli tag, split out fromfeat/wizcli-security-scan(#715) since it's a distinct concern from
wizcli scan: linking a scan result to a published registryreference by digest, rather than scanning the image itself.
Not yet functional.
wizcli tagrequires the referenced image toexist in the local Docker daemon with matching
RepoDigests, but themerge job publishes via ORAS registry-to-registry manifest copies and
never loads anything into a local daemon.
Stacked on
feat/wizcli-security-scan— do not merge until that PRmerges first.