# Gateway image build type v1

This document defines the `externalParameters` and `internalParameters` of the
Gateway image build type named by the owner signing policy. It is the
human-readable build-type specification required to interpret the repository's
SLSA provenance v1 predicate.

## Build

The GitHub-hosted `candidate` job in the immutable reusable
`.github/workflows/trusted-publish-gateway-image.yml` authority checks out the triggering `main`
commit, resolves the exact Go module pins, builds `./cmd/gateway` for
`linux/amd64`, and uses `Dockerfile.gateway` to push a run-scoped pending OCI
image. It executes no product tests or repository scripts. Those run in an
earlier fresh validation job with no registry-write, OIDC, or KMS authority.
The candidate job has registry-write access but no OIDC or KMS authority.

After that job succeeds, the isolated `sign` job acts as the release control
plane. It accepts the candidate's immutable OCI digest as the SLSA subject and
derives every other provenance value from the versioned owner policy and
GitHub-owned run context. It signs that predicate with the owner KMS key before
it signs the image and before it creates the stable source-SHA tag. The signer
does not checkout or execute the source tree. It fetches the policy and public
key only as data, validates them against workflow-owned constants, and uses
standard runner tools plus the content-pinned Cosign binary for the complete
authority-bearing path.

## Predicate parameters

`externalParameters` contains:

- `source.repository`, `source.ref`, and `source.commit`;
- the exact publisher `workflow` ref and `candidate` job name;
- `Dockerfile.gateway` as the image assembly definition;
- `linux/amd64` as the selected platform.

`internalParameters` contains the GitHub run ID, run attempt, and owner image
repository. `resolvedDependencies` contains the exact Git source revision.
`runDetails.builder.id` is the publisher workflow identity, and
`runDetails.metadata.invocationId` is the immutable GitHub Actions run-attempt
URL.

This is a signed build-provenance claim equivalent in scope to the former
GitHub `actions/attest` path. It links a released digest to its source and build
instructions; it does not claim that source code, dependencies, or the build
toolchain are vulnerability-free, and it is not a reproducible-build or SLSA
Build Level 3 claim.