ci(rds): trivy scanning + cosign signing on prebuilt images

[vieiralucas]

Summary

• Sign every published image (fakecloud, fakecloud-postgres, fakecloud-mysql, fakecloud-mariadb) with cosign keyless mode using GitHub OIDC. Signs the manifest digest, not the rolling tag.
• Run Trivy on every published tag with severity: CRITICAL,HIGH, exit-code: 1, ignore-unfixed: true — releases fail closed if a known CVE lands in our images.
• Add id-token: write to the merge job (cosign needs OIDC token access). Scan job stays read-only.
• README + docs/reference/security.md get a one-liner cosign verify quickstart so consumers can validate before pulling.

Why

Closes the supply-chain item from PR #802/#803/#804/#805's deferred list. The other deferred items already shipped (aws_s3 extension #806, async CreateDBInstance #808, MySQL/MariaDB Lambda bridge #810). With prebuilt images now part of the release, scanning + signing brings them up to the level real teams expect when pulling third-party images.

Cosign keyless mode means no key management — attestations are anchored to the GitHub workflow run that produced them, and cosign verify proves the image was built by faiscadev/fakecloud rather than republished by anyone else.

Test plan

• On a release tag (v*), each engine image gets signed and the merge step succeeds.
• cosign verify from a clean machine succeeds for all published images.
• Trivy scan job reports zero CRITICAL/HIGH findings on the latest postgres/mysql/mariadb base images.
• On docker.yml, the same flow signs ghcr.io/faiscadev/fakecloud:<version> after release.

---

Summary by cubic

Add Trivy scanning and cosign keyless signing to all published images (fakecloud, fakecloud-postgres, fakecloud-mysql, fakecloud-mariadb). Images are signed by immutable digest via GitHub OIDC, and releases fail on CRITICAL/HIGH CVEs.

• New Features
  • Sign the merged manifest digest with cosign keyless (GitHub OIDC); add id-token: write to the merge job.
  • Run Trivy on each published tag with severity=CRITICAL,HIGH, ignore-unfixed=true, exit-code=1; scan job stays read-only.
  • Apply to both workflows: docker.yml (main image) and docker-rds-images.yml (RDS images).
  • Docs: added a cosign verify quickstart in README and a new security section explaining verification.

^{Written for commit e10e393. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

2 issues found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/docker-rds-images.yml">

<violation number="1" location=".github/workflows/docker-rds-images.yml:205">
P1: The Trivy gate runs after image publish/sign, so vulnerable images can still be released before the failure is detected.</violation>
</file>

<file name=".github/workflows/docker.yml">

<violation number="1" location=".github/workflows/docker.yml:129">
P1: The vulnerability gate runs after cosign signing, so images can be signed before Trivy blocks the release. Move signing behind the scan gate (or scan before signing) so only passing images are signed.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: The Trivy gate runs after image publish/sign, so vulnerable images can still be released before the failure is detected.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/docker-rds-images.yml, line 205:

<comment>The Trivy gate runs after image publish/sign, so vulnerable images can still be released before the failure is detected.</comment>

<file context>
@@ -170,10 +171,83 @@ jobs:
+  scan:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-24.04
+    needs: merge
+    permissions:
+      contents: read
</file context>

[cubic-dev-ai]

P1: The vulnerability gate runs after cosign signing, so images can be signed before Trivy blocks the release. Move signing behind the scan gate (or scan before signing) so only passing images are signed.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/docker.yml, line 129:

<comment>The vulnerability gate runs after cosign signing, so images can be signed before Trivy blocks the release. Move signing behind the scan gate (or scan before signing) so only passing images are signed.</comment>

<file context>
@@ -105,11 +106,62 @@ jobs:
+        with:
+          cosign-release: v2.4.1
+
+      - name: Sign image with cosign (keyless, GitHub OIDC)
+        env:
+          COSIGN_EXPERIMENTAL: "1"
</file context>

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!