feat: add Crash Override Chalk integration to Docker build workflow

[gaahrdner]

Summary

• Add Crash Override Chalk integration to ghcr-build.yml workflow
• Positions Chalk setup after Docker login but before image builds
• Adds id-token: write permissions for both ghcr_build_app and ghcr_build_runtime jobs
• Uses profile: everything for comprehensive metadata collection
• Uses continue-on-error: true to ensure builds proceed even if Chalk fails

Test plan

• Verify workflow syntax is valid
• Test that Docker builds still work with Chalk integration
• Confirm Chalk metadata collection during build process
• Validate that build failures don't occur if Chalk setup fails

This integrates supply chain security monitoring into the Docker image build process to enhance security visibility and tracking of build metadata.

[linear]

SEC-135 Crash Override PoC: Docker Build Pipeline Integration

Overview

Integrate Crash Override into selected Docker build pipelines to enable "AirTag" tracking of artifacts from code to cloud.

Prerequisites

• GitHub and AWS integrations completed (SEC-132, SEC-133)
• Engineering teams recruited and onboarded (SEC-134)

Tasks

• Work with engineering teams to identify target pipelines
• For GitHub Actions pipelines:
  • Add Crash Override GitHub Action to workflow files
  • Configure setup-chalk-action with appropriate parameters
  • Test integration with sample builds
• For other build tools (if applicable):
  • Implement generic shell and curl integration
  • Test integration functionality
• Verify "AirTag" insertion and tracking
• Document integration process and troubleshooting
• Monitor initial pipeline runs for issues

Deliverables

• Pipeline integrations completed
• Build tracking verified
• Integration documentation created
• Initial monitoring established

Notes

• Focus on GitHub Actions initially (4 lines of YAML)
• Steps are built into the platform with examples available
• Coordinate closely with engineering teams for minimal disruption

name: Build

permissions:
  id-token: write

jobs:
  ...

jobs:
  build:
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Set up Chalk
          uses: crashappsec/setup-chalk-action@main
          continue-on-error: true
          with:
            connect: true