[nickpell]

Summary

• Bump github.com/cloudx-io/openauction from a621e06 (2026-08-12) to 6894ac2 to pick up Cap attestation gzip decompression at 64 KiB openauction#106, which caps AttestationCOSEGzip.Decompress output at 64 KiB. enclaveapi.AttestationCOSEGzip is an alias of openauction's type, and ValidateArbitrationAttestation calls Decompress on caller-supplied bytes before any signature check, so an attestation of a few kilobytes could inflate without limit in the validator's memory. With this bump, an 87 KB input that inflates to 64 MiB is rejected with "attestation exceeds 65536 bytes". The only other changes between the two openauction versions in the packages imported here are additions (deal fields) and removals of functions not used here (URLEncode, ExtractCOSEPayload). The PCR and certificate functions are unchanged, and no other module moves.
• Pull requests get a build-only enclave image check as a new docker-build job in the Go workflow. It builds the arm64 image with no AWS credentials and no push, and it shows as a check on the PR. The same change as ci: build the enclave image as a PR check and run Docker Build only for main openauction#108.
• Docker Build's workflow_run trigger is limited to Go runs on main. A workflow_run-triggered Docker Build always reports main's tip as its head_sha, so a PR's Docker Build could start a Build EIF run that measured main's latest commit again. The Build EIF gate comment is updated to match.

Impact

• Metric: Build EIF runs that built (not skipped), compared with the distinct commits they built; and Docker Build runs, compared with Go push runs on main
• Before: 34 EIF builds for 31 distinct commits; 97 Docker Build runs for 60 Go push runs on main (2026-09-15 16:39 to 2026-10-15 16:39 UTC)
• Query: gh api --paginate "repos/cloudx-io/openarbiter/actions/workflows/eif-build.yml/runs?created=>FROM&per_page=100" --jq '.workflow_runs[] | select(.conclusion != "skipped") | .head_sha' | sort | uniq -c (builds = sum, distinct commits = line count); the same with docker.yml, and with go.yml filtered to .event == "push" (GitHub Actions API)
• Measure after: 30 days after merge, over the 30 days since merge

Notes for reviewers

#21 recorded that Build EIF's trigger is coarser than the publish gate, so a pull request's Docker Build could start a Build EIF run that measures main's tip. It left the fix as a separate change. #1 adopted openauction's CI, where 93b30e5 ran Docker Build after Go on every branch on purpose to validate PR image builds, and #33 kept that. This PR keeps the validation and moves it into the Go workflow. A workflow_run run never appears in a PR's checks, so its result was visible only in the Actions tab.

Docker Build and Build EIF changes take effect only after merge, because workflow_run workflows use the definitions on main. The docker-build job runs on this PR.

Pre-merge checklist

• Tests pass in CI (test green on a5270da; locally all packages pass except TestGetSystemInfo_LiveProcfs, which reads /proc/meminfo and fails on macOS on main too)
• Lint passes: golangci-lint and go mod tidy in CI, Ratchet Lint, and actionlint 1.7.12 on the three changed workflows
• The new docker-build check passes on this PR, building the arm64 image without pushing
• Diff contains no unintended changes

Post-deploy/apply verification

• The first push to main after merge starts one Docker Build, which publishes the commit's image, and one Build EIF, which records the commit's PCRs in a [skip-build] Update PCR measurements commit (Go 38772616578 → Docker Build 38772697209 checked out 721ac4b and pushed its image → Build EIF 38773132657 green → PCR commit c14abac; no other Docker Build run since the merge)
• A PR's Go run after merge starts no Docker Build run, and its docker-build job runs on the PR (Count only ranked bids in the arbitration message; drop unused curl from the EIF builder setup #60 at 29b884e: Go run 38907902751 completed 2026-10-16 13:30:53 UTC with docker-build job 116996044173 green; no Docker Build run started after it)
• Impact measured: After recorded in the Impact section from its query (waiting: readable from 2026-11-14)

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

The upstream security fix and post-merge publishing workflow behavior still require verification and final human review.

0 open findings

What changed in this PR

Updates openauction to obtain the attestation decompression limit and moves PR image validation into the Go workflow.

Changes:

• Bumps openauction for the 64 KiB decompression cap.
• Adds a build-only arm64 enclave image check for PRs.
• Restricts Docker Build triggers to Go runs on main and updates the EIF gate comment.

File	Description
go.sum	Updates openauction checksums.
go.mod	Pins the updated openauction version.
.github/​workflows/​go.yml	Adds the PR image build check without publishing.
.github/​workflows/​eif-build.yml	Updates the comment describing trigger behavior.
.github/​workflows/​docker.yml	Filters triggering Go runs to main.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.