4 added, 1 removed. Audit A to A.
---
name: secure-image-build
description: Use whenever an NPA container image is built, tagged, pushed, copied, or promoted, including public full-SHA development builds, release publication, build scripts, and image-producing GitHub Actions workflows. Enforce mandatory safety gates and refuse insecure or restricted publication.
---
# Secure Image Build
Treat every official development push as public and irreversible. Use one
official namespace: `ghcr.io/nebius/nebius-physical-ai/<image>`. Tag reviewed
development bytes `dev-<full-git-sha>` and promote only that exact digest to the
supported release tag.
## Load The Governing Procedures
Read and follow these before acting; do not duplicate their detailed commands:
- `skills/atomic/solution-licensing/SKILL.md`
- `skills/atomic/build-and-push-image/SKILL.md`
- `skills/workflows/contribute-workbench-image/SKILL.md`
- `skills/atomic/third-party-eula-preflight/SKILL.md`
- `skills/atomic/testing-conventions/SKILL.md`
- `docs/workbench/container-packaging.md`
For live validation also load `skills/atomic/gpu-selection/SKILL.md`,
`skills/atomic/submit-workflow/SKILL.md`, and
`skills/atomic/protect-nebius-infra-details/SKILL.md`.
## Mandatory Sequence
1. Resolve the exact checked-out commit. Require a full 40-character Git SHA
and the immutable tag `dev-<full-git-sha>`; refuse moving or abbreviated
development tags.
2. Require `redistribution: public` in
`npa/docker/workbench/packaging-contract.yaml`. Hard-refuse `restricted`
- images, including `cosmos3-serving`, from every official GHCR tag.
+ images, including `cosmos3-super-benchmark`, from every official GHCR tag.
+ The current supported `cosmos3-serving` release is bound to its accepted,
+ payload-scanned and GPU-validated digest; historical restricted bytes remain
+ prohibited. Future development builds must pass the sequence below.
3. Before any public push, run the repository packaging/license guards and
inspect the locally built artifact, including layers, history, and OCI config.
Refuse credentials, secrets, customer data, live infrastructure identifiers,
gated weights/data, proprietary SDK/runtime payloads, or cached EULA
acceptance anywhere in the artifact.
4. Require policy-approved, digest-pinned bases/dependencies or an existing
documented packaging exception. Enforce the non-root runtime and packaging
contract. When SkyPilot needs the bootstrap contract, prove the behavior and
exact OCI attestation; never add the label without the proof.
5. Produce the SBOM and run the repository-supported vulnerability, secret,
license, payload, revision/provenance, and bootstrap checks. Do not push the
public development tag until every pre-publication gate passes.
6. Push with explicit `packages: write`, then resolve the tag once to its OCI
digest. Verify revision/provenance and SBOM attestations, rerun exact-digest
payload/security checks, and prove an anonymous pull without ambient auth.
7. Run the real functional workflow on a compatible physical GPU using the
immutable development digest. An import, startup, or CUDA-availability check
is not functional evidence.
8. Promote only the validated digest to the supported public release tag through
`npa.deploy.publish_public`. Verify anonymous pullability and exact digest
identity independently after promotion; record the exact digest identity in
`public_release_manifest.json`. Scheduled health must compare the release tag
anonymously with that `published_digest`, without depending on dev-tag retention.
9. On failure, delete only the exact run-owned development version after
matching package, tag, and digest. Never infer ownership from a name or delete
a shared/release digest. Record that deletion cannot revoke prior downloads.
Retain a successful dev tag only when the documented release policy requires
it to preserve the release's shared digest/provenance.
## Refusal Conditions
Stop before publication if any mandatory evidence is missing, a scan is
unavailable or inconclusive, the source commit/tag is mutable, redistribution is
not public, the pushed digest differs from the inspected artifact, anonymous
pull verification fails, or real GPU validation has not passed. Never weaken a
gate or substitute a label, unit test, or deletion promise for artifact evidence.