unified base-image workflow with encrypt-at-dispatch credentials

[Yogeshwar-Pawade]

Summary

Unified base-image workflow that produces every OS variant a release needs in a single workflow_dispatch, with credentials handled via age-encrypted inputs so they never appear in cleartext anywhere.

Full-house dispatch (fips=true + trusted_boot=true + all creds) produces 12 kairosified base images pushed to us-east1-docker.pkg.dev/…/edge/kairos-*:

Empirically verified end-to-end in run 29276504878 — 12/12 images built and pushed, credential audit clean.

What this PR does

1. Extends the existing kairos-init base-images.yaml

generate-matrix + kairosify jobs are preserved unchanged — same docker/bake-action + docker-bake-kairosify.hcl pipeline that already produced Ubuntu/OpenSUSE/SLEM/UKI images successfully on this branch.

Adds two new jobs:

• generate-extensions-matrix — computes RHEL + Ubuntu FIPS matrix rows based on which credentials the dispatcher supplied and whether fips=true.
• extensions — matrix-parallel builder that runs docker build per RHEL/Ubuntu-FIPS variant using BuildKit --secret mounts.

collect-outputs now aggregates tags from both matrices.

Also:

• trusted_boot=true is now additive (adds Ubuntu 24 UKI on top of the standard 5) rather than replacing them.
• New fips checkbox mirrors the trusted_boot checkbox — check it to expand the matrix with FIPS variants.

2. Encrypt-at-dispatch credential handling

Instead of raw rhel_subscription_password, users paste age-encrypted ciphertexts. Ciphertexts are useless without the private key, which lives only as the WORKFLOW_DECRYPT_KEY repo secret and is auto-masked by GitHub.

# One-time on the operator's laptop
brew install age  # or apt/dnf install age

# Every dispatch
git checkout feat/unified-base-images
./scripts/encrypt-creds.sh
# → silent prompts for RHSM user, RHSM pass, Ubuntu Pro token
# → prints 3 ciphertext blocks

# On GitHub: Run workflow → paste each block into the matching input

Plaintext credentials never leave the operator's laptop.

Test plan

• shellcheck clean across all scripts
• yaml.safe_load parses base-images.yaml
• Encrypt/decrypt roundtrip verified locally with test values
• Empty-cipher path → script exits 0 with "nothing to decrypt"
• Missing DECRYPT_KEY path → hard error with actionable message
• Full-house dispatch run 29276504878 — 12/12 images built and pushed
• Log audit of run 29276504878 — no plaintext credential material anywhere

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	23
Total	23

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (13 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 92–142 (cols 8–13) — this step
• Line 99 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 94 (cols 8–11) — this run block
• Line 100 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 101 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 102 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 103 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 104 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 9 more location(s) in this file.

unpinned-uses — High (8 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 153 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 156 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 184 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 294 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 297 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 353 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 365 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.

[bulwark-sc-ent]

⚠️ Zizmor found Critical or High severity GitHub Actions workflow security issues:

Summary

Severity	Count
High	23
Total	23

Details

Grouped by audit rule and file. Line/column refer to the workflow or action YAML on the scanned branch.

dangerous-triggers — High

use of fundamentally insecure workflow trigger

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#dangerous-triggers

Locations:

• Line 2–4 (cols 0–32) — pull_request_target is almost always used insecurely

unpinned-uses — High

unpinned action reference

File: .github/workflows/backport.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 19 (cols 14–53) — expression sorenlouv/backport-github-action@v9.5.1 — action is not pinned to a hash (required by blanket policy)

template-injection — High (13 similar finding(s))

code injection via template expansion

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#template-injection

Locations:

• Line 92–142 (cols 8–13) — this step
• Line 99 (cols 31–64) — expression github.event.inputs.base_os_image — may expand into attacker-controllable code
• Line 94 (cols 8–11) — this run block
• Line 100 (cols 33–68) — expression github.event.inputs.registry_prefix — may expand into attacker-controllable code
• Line 101 (cols 22–46) — expression github.event.inputs.arch — may expand into attacker-controllable code
• Line 102 (cols 23–48) — expression github.event.inputs.model — may expand into attacker-controllable code
• Line 103 (cols 32–66) — expression github.event.inputs.kairos_version — may expand into attacker-controllable code
• Line 104 (cols 30–62) — expression github.event.inputs.trusted_boot — may expand into attacker-controllable code
• …and 9 more location(s) in this file.

unpinned-uses — High (8 similar finding(s))

unpinned action reference

File: .github/workflows/base-images.yaml

Fix guidance: https://docs.zizmor.sh/audits/#unpinned-uses

Locations:

• Line 153 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 156 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 162 (cols 14–35) — expression docker/bake-action@v6 — action is not pinned to a hash (required by blanket policy)
• Line 184 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 294 (cols 14–33) — expression actions/checkout@v4 — action is not pinned to a hash (required by blanket policy)
• Line 297 (cols 14–43) — expression docker/setup-buildx-action@v3 — action is not pinned to a hash (required by blanket policy)
• Line 353 (cols 14–40) — expression actions/upload-artifact@v4 — action is not pinned to a hash (required by blanket policy)
• Line 365 (cols 14–42) — expression actions/download-artifact@v4 — action is not pinned to a hash (required by blanket policy)

Please review these findings before merging.