Move CCV image build into GitHub Actions

[stewartshea]

Summary

Moves the CodeCollectionVersion (CCV) image build for this repo out of the external build-system pipeline and into GitHub Actions, matching the pattern being rolled out across the codecollection repos.

• New production Dockerfile based on ghcr.io/runwhen-contrib/rw-base-runtime:latest. The runtime base ships the worker binary, Python 3, rw-core-keywords system-wide, the helper scripts at /home/runwhen/robot-runtime/, and the standard CLI tooling (kubectl, aws, az, gcloud, helm, gh, jq, yq, ...).
• Dockerfile.devcontainer keeps the existing devcontainer behavior — still uses codecollection-devtools for IDE / interactive dev. .devcontainer.json now points at it.
• .github/workflows/build-push.yaml: three-job workflow
  • prepare — single source of truth for the tag set / push flag
  • build matrix on native runners: ubuntu-latest (amd64) + ubuntu-24.04-arm (arm64), each with its own GHA cache scope. Builds natively, smoke-tests on real hardware, then pushes by digest.
  • merge — assembles the multi-arch manifest via docker buildx imagetools create under every tag.
• Tag schema matches what cc-registry-v2's OCI image catalog expects: <sanitized_ref>-<cc_sha7>-<rt_sha7>, plus moving aliases (:<branch>, :latest on main, :pr-<n> on PRs).
• Triggers: push to any branch (CCV per-branch builds), PRs against any base branch, workflow_dispatch with overrides for base_image / runtime_ref / push. paths-ignore skips docs-only diffs.

Supersedes #31, which had drifted 3 months from main and was carrying stale duplicate refactor work already merged to main via #28.

Test plan

• First push to ccv/build-pipeline auto-triggers the workflow
• Both build (amd64) and build (arm64) smoke-tests pass on native runners
• merge job publishes multi-arch manifest to ghcr.io/runwhen-contrib/aws-c7n-codecollection under the canonical + alias tags
• Manifest inspect shows two platform entries (linux/amd64, linux/arm64)
• cc-registry-v2 OCI source discovers the new tag on its next poll

Made with Cursor

---

Note

Medium Risk
Medium risk because it changes the production container base image and replaces the image build/release pipeline with new GitHub Actions workflows, which could impact image contents, tagging, and publishing behavior.

Overview
Shifts the CCV container build from the previous process into GitHub Actions by adding a new Build And Push workflow that builds native amd64/arm64 images, runs a smoke test, and publishes a multi-arch manifest to GHCR with a canonical <ref>-<cc_sha7>-<rt_sha7> tag plus branch/PR/release aliases.

Updates the production Dockerfile to base on ghcr.io/runwhen-contrib/rw-base-runtime (with optional BASE_IMAGE override) while keeping local dev on the prior tooling via a new Dockerfile.devcontainer and .devcontainer.json pointing to it.

Extends release.yaml to dispatch an image build for newly created release tags, and adds a manual build-all-branches.yaml workflow to fan out build-push.yaml runs across many branches (with include/exclude regex and runtime pinning).

^{Reviewed by Cursor Bugbot for commit 7d678f5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Script injection via unsanitized github.ref_name in shell

Medium Severity

${{ github.ref_name }} is interpolated directly into run: shell scripts, enabling script injection. Git branch names may contain shell metacharacters like $() and backticks, which the shell executes during substitution. This workflow already safely passes inputs.runtime_ref and inputs.base_image through env: variables — the same pattern needs to be applied to github.ref_name. The workflow holds packages: write and GITHUB_TOKEN, so exploitation could exfiltrate secrets or push a tampered container image to GHCR.

Additional Locations (1)

• .github/workflows/build-push.yaml#L180-L181

 

^{Reviewed by Cursor Bugbot for commit 42e3689. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7d678f5. Configure here.}

[cursor]

Hardcoded max-parallel ignores user-provided input value

Medium Severity

The dispatch job hardcodes max-parallel: 8, completely ignoring the max_parallel workflow input (default "5") that is carefully threaded through the enumerate job's output. The user-configurable value is computed and exposed as needs.enumerate.outputs.max_parallel but never consumed — the dispatch concurrency is always 8 regardless of what the operator passes.

Additional Locations (2)

• .github/workflows/build-all-branches.yaml#L43-L48
• .github/workflows/build-all-branches.yaml#L65-L66

 

^{Reviewed by Cursor Bugbot for commit 7d678f5. Configure here.}