How ekene95/secops-base-images works
This repository’s product is a Wolfi-based factory for building and maintaining hardened Java, Node.js, Python, and Go runtime images. The documented workflow discovers upstream package versions, builds and scans images, publishes them, and applies signing and provenance attestations; a nightly monitor checks published runtimes and can trigger rebuilds. The README describes these relationships, but no source excerpts were available to confirm finer-grained workflow wiring, so the graph omits uncertain links.
Main entry points: secure-java.yaml Java workflow · secure-node.yaml Node workflow · secure-python.yaml Python workflow · secure-go.yaml Go workflow
Components 22
Factory workflows
- Factory engine
.github/workflows/factory-engine.yaml - Nightly monitor
.github/workflows/nightly-monitor.yaml - Java workflow
.github/workflows/secure-java.yaml - Node workflow
.github/workflows/secure-node.yaml - Python workflow
.github/workflows/secure-python.yaml - Go workflow
.github/workflows/secure-go.yaml - Go runtime workflow
.github/workflows/secure-go-runtime.yaml
Java runtime
- Java image definitions
images/wolfi-java/wolfi-java.yaml - Java 17 definition
images/wolfi-java/wolfi-java-17.yaml - Java 21 definition
images/wolfi-java/wolfi-java-21.yaml - Java 25 definition
images/wolfi-java/wolfi-java-25.yaml
Node runtime
- Node image definitions
images/wolfi-node/wolfi-node-20.yaml - Node 22 definition
images/wolfi-node/wolfi-node-22.yaml - Node 24 definition
images/wolfi-node/wolfi-node-24.yaml
Python and Go runtimes
- Python image definition
images/wolfi-python/wolfi-python.yaml - Go image definition
images/wolfi-go/wolfi-go.yaml - Go runtime definition
images/wolfi-go-runtime/wolfi-go-runtime.yaml
Other components
- Runtime consumers
- Wolfi package index
- Container registry
- Trivy scanner
- Cosign and SLSA
Connections 37
- Runtime consumers → Container registry: pulls runtimes
- Java workflow → Java image definitions: builds from
- Node workflow → Node image definitions: builds from
- Python workflow → Python image definition: builds from
- Go workflow → Go image definition: builds from
- Go runtime workflow → Go runtime definition: builds from
- Java workflow → Wolfi package index: discovers versions
- Node workflow → Wolfi package index: discovers versions
- Python workflow → Wolfi package index: discovers versions
- Go workflow → Wolfi package index: discovers versions
- Go runtime workflow → Wolfi package index: discovers versions
- Java workflow → Factory engine: uses build engine
- Node workflow → Factory engine: uses build engine
- Python workflow → Factory engine: uses build engine
- Go workflow → Factory engine: uses build engine
- Go runtime workflow → Factory engine: uses build engine
- Java workflow → Trivy scanner: scans images
- Node workflow → Trivy scanner: scans images
- Python workflow → Trivy scanner: scans images
- Go workflow → Trivy scanner: scans images
- Go runtime workflow → Trivy scanner: scans images
- Java workflow → Container registry: publishes images
- Node workflow → Container registry: publishes images
- Python workflow → Container registry: publishes images
- Go workflow → Container registry: publishes images
- Go runtime workflow → Container registry: publishes images
- Java workflow → Cosign and SLSA: attests images
- Node workflow → Cosign and SLSA: attests images
- Python workflow → Cosign and SLSA: attests images
- Go workflow → Cosign and SLSA: attests images
- Go runtime workflow → Cosign and SLSA: attests images
- Nightly monitor → Container registry: scans production
- Nightly monitor → Java workflow: dispatches rebuild
- Nightly monitor → Node workflow: dispatches rebuild
- Nightly monitor → Python workflow: dispatches rebuild
- Nightly monitor → Go workflow: dispatches rebuild
- Nightly monitor → Go runtime workflow: dispatches rebuild