Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

.github/workflows/testgrid-publish.yml (1)

131-149: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Move bundle_ref input out of the shell template.

Line 133 still injects the manual bundle_ref input directly into run:. A value containing shell metacharacters can break out before WIF-backed publishing. Pass it via env and validate the final ref before writing GITHUB_OUTPUT.

🛡️ Proposed fix

       - name: Resolve bundle ref
         id: bundle
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_BUNDLE_REF: ${{ inputs.bundle_ref }}
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            BUNDLE_REF="${{ inputs.bundle_ref }}"
+          if [ "${EVENT_NAME}" = "workflow_dispatch" ]; then
+            BUNDLE_REF="${INPUT_BUNDLE_REF}"
           else
             POINTER="$(find evidence-pointer/ -name 'pointer.yaml' | head -1)"
             if [ -z "${POINTER}" ]; then
               echo "::error::No pointer.yaml found in evidence pointer artifact"
@@
             fi
             BUNDLE_REF="${OCI}@${DIGEST}"
           fi
-          echo "bundle_ref=${BUNDLE_REF}" >> "${GITHUB_OUTPUT}"
+          if [[ ! "${BUNDLE_REF}" =~ ^ghcr\.io/nvidia/[^[:space:]]+@sha256:[0-9a-fA-F]{64}$ ]]; then
+            echo "::error::bundle_ref must be ghcr.io/nvidia/...@sha256:<64 hex chars>"
+            exit 1
+          fi
+          printf 'bundle_ref=%s\n' "${BUNDLE_REF}" >> "${GITHUB_OUTPUT}"
           echo "Resolved bundle: ${BUNDLE_REF}"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/testgrid-publish.yml around lines 131 - 149, The workflow
step still interpolates the manual bundle_ref input directly inside the shell
script, which can allow shell metacharacters to affect execution. Update the
publishing step to pass bundle_ref through env instead of embedding it in run,
then use that variable in the workflow_dispatch branch and validate the final
BUNDLE_REF before echoing it to GITHUB_OUTPUT. Keep the fix localized to the
workflow step that sets BUNDLE_REF and writes bundle_ref.

Source: Linters/SAST tools

.github/workflows/testgrid-publish.yml (1)

95-107: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Reject untrusted producer heads before publishing.

This guard still publishes non-main runs and checks workflow_run.repository.full_name instead of the producer head repository. Use github.event.workflow_run.head_repository.full_name and fail on non-main so fork/branch runs cannot reach WIF-backed publishing.

🛡️ Proposed fix

-          PRODUCER_REPO: ${{ github.event.workflow_run.repository.full_name }}
+          PRODUCER_REPO: ${{ github.event.workflow_run.head_repository.full_name }}
           PRODUCER_BRANCH: ${{ github.event.workflow_run.head_branch }}
@@
           if [ "${PRODUCER_BRANCH}" != "main" ]; then
-            echo "::warning::Producer ran on branch '${PRODUCER_BRANCH}' (not main) — publishing anyway"
+            echo "::error::Producer ran on branch '${PRODUCER_BRANCH}' (not main) — rejecting"
+            exit 1
           fi

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/testgrid-publish.yml around lines 95 - 107, In the
Validate producer step, the workflow is still allowing non-main producer runs to
publish and is checking the wrong repository field. Update the guard in the
workflow_run path to use github.event.workflow_run.head_repository.full_name
instead of github.event.workflow_run.repository.full_name, and make the branch
check on github.event.workflow_run.head_branch fail the job for anything other
than main so untrusted fork/branch heads cannot reach the publishing flow.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

.goreleaser.yaml (1)

201-207: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

Release artifact ships without integrity/attestation material.

This testgrid-publish archive is downloaded and executed by .github/workflows/testgrid-publish.yml under WIF-issued GCP credentials, yet—unlike the aicr archive (lines 214-222)—it carries no checksum/attestation bundle. Either publish and verify signed integrity metadata for this artifact, or keep the workflow source-built only.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.goreleaser.yaml around lines 201 - 207, The testgrid-publish release
artifact is being shipped without any integrity or attestation material, unlike
the aicr artifact setup. Update the goreleaser configuration for the
testgrid-publish entry so it publishes signed checksum/attestation metadata, and
make sure the .github/workflows/testgrid-publish.yml flow verifies that metadata
before execution. If signed verification cannot be added, adjust the workflow to
build from source instead of downloading and running the release archive.

.github/workflows/testgrid-publish.yml (2)

164-178: 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift

Don’t silently skip failed UAT runs that should produce columns.

The workflow advertises failure columns, but missing pointer artifacts on failed producer runs become a successful skip. Either make producers always upload a failure evidence pointer, or restrict this workflow to conclusions with a guaranteed pointer contract.

Also applies to: 207-214

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/testgrid-publish.yml around lines 164 - 178, The “Download
evidence pointer” step in the testgrid publish workflow is treating missing
pointer artifacts from failed UAT runs as a benign skip, which can hide failure
columns. Update the workflow logic around the download-pointer step and the
downstream bundle resolution so it only runs when the producer guarantees a
pointer contract, or change the producer side to always upload a failure
evidence pointer for failed runs; use the existing workflow_run gating and the
download-pointer step’s outcome handling to make the failure path explicit
instead of silently succeeding.

---

87-90: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Reject non-main producer runs before WIF-capable publishing.

Line 121 only warns for non-main producers, but the job still proceeds to download attacker-influenced artifacts and later obtains GCP credentials. Tighten the job condition and make the producer validation fail closed; workflow_run is specifically called out by GitHub as risky when it can grant write/secrets access from triggering-workflow data. (docs.github.com)

🛡️ Proposed fix

     if: >
       (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') ||
-      github.event.workflow_run.conclusion == 'success' ||
-      github.event.workflow_run.conclusion == 'failure'
+      (
+        github.event_name == 'workflow_run' &&
+        github.event.workflow_run.head_repository.full_name == github.repository &&
+        github.event.workflow_run.head_branch == 'main' &&
+        (
+          github.event.workflow_run.conclusion == 'success' ||
+          github.event.workflow_run.conclusion == 'failure'
+        )
+      )
@@
-          PRODUCER_REPO: ${{ github.event.workflow_run.repository.full_name }}
+          PRODUCER_REPO: ${{ github.event.workflow_run.head_repository.full_name }}
           PRODUCER_BRANCH: ${{ github.event.workflow_run.head_branch }}
@@
           if [ "${PRODUCER_BRANCH}" != "main" ]; then
-            echo "::warning::Producer ran on branch '${PRODUCER_BRANCH}' (not main) — publishing anyway"
+            echo "::error::Producer ran on branch '${PRODUCER_BRANCH}' (not main) — rejecting"
+            exit 1
           fi

Also applies to: 113-123

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/testgrid-publish.yml around lines 87 - 90, The testgrid
publish workflow currently allows workflow_run executions from non-main producer
branches to continue, which can lead to downloading untrusted artifacts before
GCP/WIF access is granted. Tighten the job-level `if` in testgrid-publish.yml so
`workflow_run` only proceeds when the producing workflow is on `main`, and make
the producer validation step in the publish job fail closed instead of only
warning. Use the existing `workflow_run` gating and the validation logic around
the producer branch check to locate the change.

Source: Linters/SAST tools

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

.github/workflows/testgrid-publish.yml (2)

131-135: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Reject unexpected same-repo branches, not just forks.

Line 133 currently allows every non-main branch and only logs a notice, so any same-repo feature branch running a matching UAT workflow can drive a privileged prod TestGrid publish. If release branches are intended, allowlist them explicitly and fail everything else before WIF auth.

🛡️ Proposed fix

-          # Release branches (e.g. release/v1.x) intentionally publish —
-          # their UAT runs qualify the release and belong in TestGrid.
-          if [ "${PRODUCER_BRANCH}" != "main" ]; then
-            echo "::notice::Producer ran on branch '${PRODUCER_BRANCH}' — publishing (release branches are intentional)"
-          fi
+          case "${PRODUCER_BRANCH}" in
+            main|release/*)
+              echo "::notice::Producer ran on branch '${PRODUCER_BRANCH}' — publishing"
+              ;;
+            *)
+              echo "::error::Producer ran on unexpected branch '${PRODUCER_BRANCH}' — rejecting"
+              exit 1
+              ;;
+          esac

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/testgrid-publish.yml around lines 131 - 135, The branch
gate in the publish workflow is too broad because it treats every non-main
PRODUCER_BRANCH as publishable; tighten the check so only explicitly allowlisted
release branches are accepted and all other same-repo branches fail before WIF
auth. Update the branch validation logic in the testgrid publish workflow around
the PRODUCER_BRANCH notice to reject unexpected branches, keeping the intent for
release branches clear while preventing privileged publishes from feature
branches.

Source: Linters/SAST tools

---

242-248: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Validate the whole bundle ref before writing GITHUB_OUTPUT.

grep -qE is line-based, so valid-ref\nextra=value can pass because one line matches, then Line 248 writes injected output lines. Use Bash regex on the variable and a stricter path character class.

🛡️ Proposed fix

-          if ! echo "${BUNDLE_REF}" | grep -qE '^ghcr\.io/nvidia/[^@]+@sha256:[0-9a-f]{64}$'; then
+          if [[ ! "${BUNDLE_REF}" =~ ^ghcr\.io/nvidia/[A-Za-z0-9._/-]+@sha256:[0-9a-f]{64}$ ]]; then
             echo "::error::BUNDLE_REF '${BUNDLE_REF}' does not match expected format ghcr.io/nvidia/...@sha256:<64hex>"
             exit 1
           fi

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/testgrid-publish.yml around lines 242 - 248, The bundle
ref check in the testgrid publish workflow is only validating a single line with
grep, so a multiline value can still inject extra GITHUB_OUTPUT entries. Update
the validation around BUNDLE_REF to use a Bash regex match on the full variable
before the echo to GITHUB_OUTPUT, and tighten the allowed ghcr.io/nvidia path
character class so only a single safe bundle ref can pass.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes