41520055803
84%

Ran 02 Nov 2026 08:51PM UTC

Jobs 1

Files 60

Run time 1min

Badge

Embed ▾

Committed 02 Nov 2026 08:31PM UTC coverage: 84.074% (+0.1%) from 83.961%

Build # 41520055803

Build Type

push

github

Committed by

web-flow

Commit Message

feat(cli): publish each CLI platform as a one-layer image so scanners can read it (#947)

Each platform manifest of ghcr.io/nvidia/nodewright/cli carried the bare
binary as an application/octet-stream layer. Scanners read only image layers:
syft and grype refuse that layer, and Trivy reports the target as not scanned
while exiting 0. Each platform is now an image whose single
application/vnd.oci.image.layer.v1.tar+gzip layer holds kubectl-nodewright
(mode 0755), with a real image config, the layout Homebrew uses for its
bottles. artifactType still names the CLI. The push stays reproducible from
the tagged commit's time.

The install script extracts the binary from the layer. With every platform an
image, the SBOM is generated from the registry like the operator's and agent's,
so cosign-attest-multiplatform drops binaries-dir, and the weekly scan pulls
the CLI per platform through GRYPE_PLATFORM instead of wrapping the binary
itself.

Closes #946

Signed-off-by: Brian Lockwood <lockwobr@gmail.com>

Coverage Stats

10463 of 12445 relevant lines covered (84.07%)

7.68 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	41520055803.1	02 Nov 2026 08:51PM UTC	60	84.07	GitHub Action Run

NVIDIA / nodewright / 41520055803
84%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 41520055803

NVIDIA / nodewright / 41520055803 84%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 41520055803

NVIDIA / nodewright / 41520055803
84%

README BADGES
x