ci(security): gate tagged releases on scans

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

.github/workflows/codex-security.yml

@@ -4,9 +4,6 @@
 name: Codex Security Release Qualification
 
 on:
-  push:
-    tags:
-      - "v*.*.*-pre.*"
   workflow_call:
     inputs:
       candidate_ref:

.github/workflows/release-tag.yml

@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - "v*.*.*"
+      - "!v*.*.*-pre.*"
   workflow_dispatch:
     inputs:
       tag:
@@ -129,6 +130,26 @@ jobs:
       image-tag: ${{ needs.compute-versions.outputs.source_sha }}
       checkout-ref: ${{ needs.compute-versions.outputs.source_sha }}
 
+  security:
+    name: Security Scan
+    needs: [compute-versions, build-images]
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
+    uses: ./.github/workflows/security-scan.yml
+    with:
+      candidate_ref: ${{ inputs.tag || github.ref_name }}
+      allow-high-critical: false
+      images: |
+        ghcr.io/nvidia/openshell/gateway:${{ needs.compute-versions.outputs.source_sha }}
+        ghcr.io/nvidia/openshell/sandbox:${{ needs.compute-versions.outputs.source_sha }}
+        ghcr.io/nvidia/openshell/supervisor:${{ needs.compute-versions.outputs.source_sha }}
+    secrets:
+      CODEX_SECURITY_API_KEY: ${{ secrets.CODEX_SECURITY_API_KEY }}
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+
   prepare-integration:
     needs: [compute-versions, build-binaries, build-deb, build-images]
     permissions:
@@ -308,6 +329,7 @@ jobs:
       - feature-specific-integration
       - docker-e2e
       - vm-e2e
+      - security
       - build-deb
       - build-rpm
       - build-snap

.github/workflows/security-scan.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
     inputs:
       candidate_ref:
-        description: Pre-release tag to scan (vMAJOR.MINOR.PATCH-pre.N)
+        description: Release tag to scan; Codex runs only for pre-release tags
         required: true
         type: string
       stable_ref:
@@ -33,7 +33,7 @@ on:
   workflow_call:
     inputs:
       candidate_ref:
-        description: Pre-release tag to scan (vMAJOR.MINOR.PATCH-pre.N)
+        description: Release tag to scan; Codex runs only for pre-release tags
         required: true
         type: string
       stable_ref:
@@ -69,6 +69,7 @@ permissions:
 jobs:
   codex:
     name: Codex Security
+    if: contains(inputs.candidate_ref, '-pre.')
     uses: ./.github/workflows/codex-security.yml
     permissions:
       actions: read

CI.md

@@ -89,13 +89,13 @@ nix develop --command zizmor --offline --persona=regular --min-severity=high --n
 
 ## Run the security scans together
 
-`Security Scan` (`.github/workflows/security-scan.yml`) calls Codex Security,
-CodeQL, Trivy, Cargo Deny, and Workflow Security Reports (Actionlint/Zizmor) in
-parallel. Run it manually from Actions or call it from another workflow. All
-children scan `candidate_ref`, which must be an existing `vX.Y.Z-pre.N` tag
-because Codex qualifies pre-releases. Codex compares it with the previous stable;
-the other scanners analyze the candidate snapshot. Cargo Deny uses its existing
-NVIDIA self-hosted runner and CI container.
+`Security Scan` (`.github/workflows/security-scan.yml`) calls CodeQL, Trivy,
+Cargo Deny, and Workflow Security Reports (Actionlint/Zizmor) in parallel for a
+release tag. It additionally calls Codex Security for `vX.Y.Z-pre.N` tags, which
+Codex compares with the previous stable release. Run the parent manually from
+Actions or call it from another workflow. All applicable children analyze the
+candidate snapshot. Cargo Deny uses its existing NVIDIA self-hosted runner and
+CI container.
 
 ```shell
 gh workflow run security-scan.yml --ref main \
@@ -132,6 +132,8 @@ jobs:
 ```
 
 Set `needs: security` on a downstream promotion job to require successful scans.
+The tagged release workflow does this after publishing its commit-addressed OCI
+images, so failed scans or High/Critical findings block release publication.
 
 `CODEX_SECURITY_API_KEY` is required; `CACHIX_AUTH_TOKEN` is optional. The parent
 publishes SARIF, including Codex results for manual parent runs. Codex keeps its
@@ -375,7 +377,7 @@ These workflows run after merge to publish dev/tagged artifacts and verify them.
 | File | Role |
 |---|---|
 | `.github/workflows/release-dev.yml` | Publishes the rolling `dev` build on every push to `main`. Builds gateway, sandbox, and supervisor images and binaries, packages, wheels, and pushes the Helm chart as `oci://ghcr.io/nvidia/openshell/helm-chart:0.0.0-dev` (plus an immutable `0.0.0-dev.<sha>` pin). Also dispatchable manually. |
-| `.github/workflows/release-tag.yml` | Publishes a tagged stable release. Its automatic tag trigger excludes `-pre.*`; manual dispatch remains maintainer-controlled. |
+| `.github/workflows/release-tag.yml` | Publishes tagged stable releases and manually dispatched pre-releases. Its automatic tag trigger excludes `-pre.*`. Security Scan gates release publication. |
 | `.github/workflows/release-canary.yml` | Smoke-tests published dev artifacts on `macos`, `ubuntu`, `fedora`, and `kubernetes` (kind + Helm) runners. Each job reaches its gateway and creates, exercises, and deletes a sandbox. It runs automatically after `Release Dev` succeeds and supports manual dispatch (`gh workflow run release-canary.yml --ref <branch>`). See the `test-release-canary` skill for the playbook and local kind reproduction. |
 
 ## Required status contexts

architecture/build.md

@@ -368,8 +368,9 @@ Triggers differ by workflow: `.github/workflows/workflow-security.yml` runs on
 `merge_group` only, because it needs a base and head commit to compare;
 `.github/workflows/codeql.yml` runs nightly on the default branch (`main`) via
 `schedule`, with `workflow_dispatch` kept for manual diagnostics; and
-`.github/workflows/codex-security.yml` runs on pushed `v*.*.*-pre.*` tags, and is
-also callable through `workflow_call` and `workflow_dispatch`. CodeQL does
+`.github/workflows/codex-security.yml` is called by the aggregate release scan
+for pre-release tags and is also callable through `workflow_call` and
+`workflow_dispatch`. CodeQL does
 not run on `pull_request`, `merge_group`, or pushes to `main`, so it reports
 repository-level Code Scanning state on the default branch instead of per-PR
 results, and its four-language matrix stays off the per-change critical path.
@@ -480,6 +481,13 @@ workflow only reports on candidates that already exist. Gating stable promotion
 on qualification results remains proposed in
 [RFC 0014](../rfc/0014-release-stability/release-qualification.md).
 
+The tagged release workflow calls the aggregate Security Scan after publishing
+the candidate's commit-addressed gateway, sandbox, and supervisor images. CodeQL,
+Trivy, Cargo Deny, and Actionlint/Zizmor run for every release tag; Codex Security
+also runs for pre-release tags. The release job depends on the aggregate result,
+which fails on scanner errors, Cargo Deny advisories, and unexcepted High or
+Critical findings.
+
 `release-auto-tag.yml` runs at 14:00 Europe/Zurich on weekdays (including daylight
 saving time changes) and supports manual dispatch. Maintainers start weekday
 pre-release publishing by tagging the initial `vX.Y.Z-pre.1` release candidate.