# ekene95/secops-base-images architecture

> Architecture diagram of the GitHub repository ekene95/secops-base-images, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ekene95/secops-base-images
- Repository: https://github.com/ekene95/secops-base-images

## Overview

This repository’s product is a Wolfi-based factory for building and maintaining hardened Java, Node.js, Python, and Go runtime images. The documented workflow discovers upstream package versions, builds and scans images, publishes them, and applies signing and provenance attestations; a nightly monitor checks published runtimes and can trigger rebuilds. The README describes these relationships, but no source excerpts were available to confirm finer-grained workflow wiring, so the graph omits uncertain links.

Main entry points: [`.github/workflows/secure-java.yaml`](https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-java.yaml) (Java workflow), [`.github/workflows/secure-node.yaml`](https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-node.yaml) (Node workflow), [`.github/workflows/secure-python.yaml`](https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-python.yaml) (Python workflow), [`.github/workflows/secure-go.yaml`](https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-go.yaml) (Go workflow)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_factory["Factory workflows"]
  node_engine["Factory engine"]
  node_monitor["Nightly monitor"]
  node_javaflow["Java workflow<br/>[secure-java.yaml]"]
  node_nodeflow["Node workflow<br/>[secure-node.yaml]"]
  node_pythonflow["Python workflow<br/>[secure-python.yaml]"]
  node_goflow["Go workflow<br/>[secure-go.yaml]"]
  node_goruntimeflow["Go runtime workflow"]
end

subgraph group_java["Java runtime"]
  node_java["Java image definitions<br/>[wolfi-java.yaml]"]
  node_java17["Java 17 definition<br/>[wolfi-java-17.yaml]"]
  node_java21["Java 21 definition<br/>[wolfi-java-21.yaml]"]
  node_java25["Java 25 definition<br/>[wolfi-java-25.yaml]"]
end

subgraph group_node["Node runtime"]
  node_node["Node image definitions<br/>[wolfi-node-20.yaml]"]
  node_node22["Node 22 definition<br/>[wolfi-node-22.yaml]"]
  node_node24["Node 24 definition<br/>[wolfi-node-24.yaml]"]
end

subgraph group_pygo["Python and Go runtimes"]
  node_python["Python image definition<br/>[wolfi-python.yaml]"]
  node_go["Go image definition<br/>[wolfi-go.yaml]"]
  node_goruntime["Go runtime definition"]
end

node_developer(("Runtime consumers"))
node_wolfi[("Wolfi package index")]
node_registry[("Container registry")]
node_security["Trivy scanner"]
node_sigstore["Cosign and SLSA"]

node_developer -->|"pulls runtimes"| node_registry
node_javaflow -->|"builds from"| node_java
node_nodeflow -->|"builds from"| node_node
node_pythonflow -->|"builds from"| node_python
node_goflow -->|"builds from"| node_go
node_goruntimeflow -->|"builds from"| node_goruntime
node_javaflow -->|"discovers versions"| node_wolfi
node_nodeflow -->|"discovers versions"| node_wolfi
node_pythonflow -->|"discovers versions"| node_wolfi
node_goflow -->|"discovers versions"| node_wolfi
node_goruntimeflow -->|"discovers versions"| node_wolfi
node_javaflow -->|"uses build engine"| node_engine
node_nodeflow -->|"uses build engine"| node_engine
node_pythonflow -->|"uses build engine"| node_engine
node_goflow -->|"uses build engine"| node_engine
node_goruntimeflow -->|"uses build engine"| node_engine
node_javaflow -->|"scans images"| node_security
node_nodeflow -->|"scans images"| node_security
node_pythonflow -->|"scans images"| node_security
node_goflow -->|"scans images"| node_security
node_goruntimeflow -->|"scans images"| node_security
node_javaflow -->|"publishes images"| node_registry
node_nodeflow -->|"publishes images"| node_registry
node_pythonflow -->|"publishes images"| node_registry
node_goflow -->|"publishes images"| node_registry
node_goruntimeflow -->|"publishes images"| node_registry
node_javaflow -->|"attests images"| node_sigstore
node_nodeflow -->|"attests images"| node_sigstore
node_pythonflow -->|"attests images"| node_sigstore
node_goflow -->|"attests images"| node_sigstore
node_goruntimeflow -->|"attests images"| node_sigstore
node_monitor -->|"scans production"| node_registry
node_monitor -.->|"dispatches rebuild"| node_javaflow
node_monitor -.->|"dispatches rebuild"| node_nodeflow
node_monitor -.->|"dispatches rebuild"| node_pythonflow
node_monitor -.->|"dispatches rebuild"| node_goflow
node_monitor -.->|"dispatches rebuild"| node_goruntimeflow

click node_engine "https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/factory-engine.yaml"
click node_monitor "https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/nightly-monitor.yaml"
click node_javaflow "https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-java.yaml"
click node_nodeflow "https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-node.yaml"
click node_pythonflow "https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-python.yaml"
click node_goflow "https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-go.yaml"
click node_goruntimeflow "https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-go-runtime.yaml"
click node_java "https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-java/wolfi-java.yaml"
click node_java17 "https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-java/wolfi-java-17.yaml"
click node_java21 "https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-java/wolfi-java-21.yaml"
click node_java25 "https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-java/wolfi-java-25.yaml"
click node_node "https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-node/wolfi-node-20.yaml"
click node_node22 "https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-node/wolfi-node-22.yaml"
click node_node24 "https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-node/wolfi-node-24.yaml"
click node_python "https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-python/wolfi-python.yaml"
click node_go "https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-go/wolfi-go.yaml"
click node_goruntime "https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-go-runtime/wolfi-go-runtime.yaml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_engine,node_monitor,node_javaflow,node_nodeflow,node_pythonflow,node_goflow,node_goruntimeflow toneBlue
class node_java,node_java17,node_java21,node_java25,node_wolfi,node_registry toneAmber
class node_node,node_node22,node_node24 toneMint
class node_python,node_go,node_goruntime toneRose
class node_developer,node_security,node_sigstore toneIndigo
```

## Components

### Factory workflows

- [Factory engine](https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/factory-engine.yaml): `.github/workflows/factory-engine.yaml`
- [Nightly monitor](https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/nightly-monitor.yaml): `.github/workflows/nightly-monitor.yaml`
- [Java workflow](https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-java.yaml): `.github/workflows/secure-java.yaml`
- [Node workflow](https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-node.yaml): `.github/workflows/secure-node.yaml`
- [Python workflow](https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-python.yaml): `.github/workflows/secure-python.yaml`
- [Go workflow](https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-go.yaml): `.github/workflows/secure-go.yaml`
- [Go runtime workflow](https://github.com/ekene95/secops-base-images/blob/master/.github/workflows/secure-go-runtime.yaml): `.github/workflows/secure-go-runtime.yaml`

### Java runtime

- [Java image definitions](https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-java/wolfi-java.yaml): `images/wolfi-java/wolfi-java.yaml`
- [Java 17 definition](https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-java/wolfi-java-17.yaml): `images/wolfi-java/wolfi-java-17.yaml`
- [Java 21 definition](https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-java/wolfi-java-21.yaml): `images/wolfi-java/wolfi-java-21.yaml`
- [Java 25 definition](https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-java/wolfi-java-25.yaml): `images/wolfi-java/wolfi-java-25.yaml`

### Node runtime

- [Node image definitions](https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-node/wolfi-node-20.yaml): `images/wolfi-node/wolfi-node-20.yaml`
- [Node 22 definition](https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-node/wolfi-node-22.yaml): `images/wolfi-node/wolfi-node-22.yaml`
- [Node 24 definition](https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-node/wolfi-node-24.yaml): `images/wolfi-node/wolfi-node-24.yaml`

### Python and Go runtimes

- [Python image definition](https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-python/wolfi-python.yaml): `images/wolfi-python/wolfi-python.yaml`
- [Go image definition](https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-go/wolfi-go.yaml): `images/wolfi-go/wolfi-go.yaml`
- [Go runtime definition](https://github.com/ekene95/secops-base-images/blob/master/images/wolfi-go-runtime/wolfi-go-runtime.yaml): `images/wolfi-go-runtime/wolfi-go-runtime.yaml`

### Other components

- **Runtime consumers**
- **Wolfi package index**
- **Container registry**
- **Trivy scanner**
- **Cosign and SLSA**

## Connections

- Runtime consumers → Container registry: pulls runtimes
- Java workflow → Java image definitions: builds from
- Node workflow → Node image definitions: builds from
- Python workflow → Python image definition: builds from
- Go workflow → Go image definition: builds from
- Go runtime workflow → Go runtime definition: builds from
- Java workflow → Wolfi package index: discovers versions
- Node workflow → Wolfi package index: discovers versions
- Python workflow → Wolfi package index: discovers versions
- Go workflow → Wolfi package index: discovers versions
- Go runtime workflow → Wolfi package index: discovers versions
- Java workflow → Factory engine: uses build engine
- Node workflow → Factory engine: uses build engine
- Python workflow → Factory engine: uses build engine
- Go workflow → Factory engine: uses build engine
- Go runtime workflow → Factory engine: uses build engine
- Java workflow → Trivy scanner: scans images
- Node workflow → Trivy scanner: scans images
- Python workflow → Trivy scanner: scans images
- Go workflow → Trivy scanner: scans images
- Go runtime workflow → Trivy scanner: scans images
- Java workflow → Container registry: publishes images
- Node workflow → Container registry: publishes images
- Python workflow → Container registry: publishes images
- Go workflow → Container registry: publishes images
- Go runtime workflow → Container registry: publishes images
- Java workflow → Cosign and SLSA: attests images
- Node workflow → Cosign and SLSA: attests images
- Python workflow → Cosign and SLSA: attests images
- Go workflow → Cosign and SLSA: attests images
- Go runtime workflow → Cosign and SLSA: attests images
- Nightly monitor → Container registry: scans production
- Nightly monitor → Java workflow: dispatches rebuild
- Nightly monitor → Node workflow: dispatches rebuild
- Nightly monitor → Python workflow: dispatches rebuild
- Nightly monitor → Go workflow: dispatches rebuild
- Nightly monitor → Go runtime workflow: dispatches rebuild