merge, disable VEXs and bump tags

Author: timothycarambat

.github/workflows/build-and-push-pg-image.yaml

@@ -6,16 +6,16 @@ concurrency:
 
 on:
   push:
-    branches: ['pg']
+    branches: ["pg"]
     paths-ignore:
-      - '**.md'
-      - 'cloud-deployments/*'
-      - 'images/**/*'
-      - '.vscode/**/*'
-      - '**/.env.example'
-      - '.github/ISSUE_TEMPLATE/**/*'
-      - 'embed/**/*' # Embed should be published to frontend (yarn build:publish) if any changes are introduced
-      - 'server/utils/agents/aibitat/example/**/*' # Do not push new image for local dev testing of new aibitat images.
+      - "**.md"
+      - "cloud-deployments/*"
+      - "images/**/*"
+      - ".vscode/**/*"
+      - "**/.env.example"
+      - ".github/ISSUE_TEMPLATE/**/*"
+      - "embed/**/*" # Embed should be published to frontend (yarn build:publish) if any changes are introduced
+      - "server/utils/agents/aibitat/example/**/*" # Do not push new image for local dev testing of new aibitat images.
 
 jobs:
   push_to_registries:
@@ -50,7 +50,7 @@ jobs:
       - name: Log in to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
         # Only login to the Docker Hub if the repo is mintplex/anythingllm, to allow for forks to build on GHCR
-        if: steps.dockerhub.outputs.enabled == 'true' 
+        if: steps.dockerhub.outputs.enabled == 'true'
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -63,7 +63,7 @@ jobs:
             ${{ steps.dockerhub.outputs.enabled == 'true' && 'mintplexlabs/anythingllm' || '' }}
           tags: |
             type=raw,value=pg
-            type=raw,value=pg-1.15.0
+            type=raw,value=pg-1.16.0
 
       - name: Build and push multi-platform Docker image
         uses: docker/build-push-action@v6
@@ -80,39 +80,11 @@ jobs:
           cache-to: type=gha,mode=max
           build-args: |
             "STORAGE_DIR=/storage"
-      
-      # For Docker scout there are some intermediary reported CVEs which exists outside
-      # of execution content or are unreachable by an attacker but exist in image.
-      # We create VEX files for these so they don't show in scout summary. 
-      - name: Collect known and verified CVE exceptions
-        id: cve-list
-        run: |
-          # Collect CVEs from filenames in vex folder
-          CVE_NAMES=""
-          for file in ./docker/vex/*.vex.json; do
-            [ -e "$file" ] || continue
-            filename=$(basename "$file")
-            stripped_filename=${filename%.vex.json}
-            CVE_NAMES+=" $stripped_filename"
-          done
-          echo "CVE_EXCEPTIONS=$CVE_NAMES" >> $GITHUB_OUTPUT
-        shell: bash
 
-      # About VEX attestations https://docs.docker.com/scout/explore/exceptions/
-      # Justifications https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md#status-justifications
-      - name: Add VEX attestations
-        env:
-          CVE_EXCEPTIONS: ${{ steps.cve-list.outputs.CVE_EXCEPTIONS }}
-        run: |
-          echo $CVE_EXCEPTIONS
-          curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s --
-          for cve in $CVE_EXCEPTIONS; do
-            for tag in "${{ join(fromJSON(steps.meta.outputs.json).tags, ' ') }}"; do
-              echo "Attaching VEX exception $cve to $tag"
-              docker scout attestation add \
-              --file "./docker/vex/$cve.vex.json" \
-              --predicate-type https://openvex.dev/ns/v0.2.0 \
-              $tag
-            done
-          done
-        shell: bash
+      # VEX attestations are currently broken with docker scout when attaching
+      # multiple attestations to multi-platform images. The second attachment
+      # fails with "mismatched fs layers and diff ids".
+      # TODO: Re-enable when docker/scout-cli fixes this upstream.
+      # See: https://docs.docker.com/scout/explore/exceptions/
+      # - name: Collect known and verified CVE exceptions
+      # - name: Add VEX attestations