What does your image pipeline prove about the artifact you deploy?

Say it in 30 seconds

Say it like this (20-30 seconds)

MiniTickets publishes commit-tagged images to immutable ECR repositories and records their digests, so a deployment can identify the artifact it uses. CI audits dependencies and scans images for fixable critical vulnerabilities. Those controls reduce risk, but they do not prove the code is safe or that the separately published ARM64 image is byte-for-byte the CI scan image. I would state that gap and strengthen artifact verification before a higher-risk production release.

The deeper answer

A tag is a name; a digest identifies image content. Immutable tags prevent a later push from changing the bytes behind the same tag, but do not prove who produced those bytes. Authorization and build integrity remain separate concerns.

CI builds scan images and Trivy checks critical vulnerabilities with ignore-unfixed: true, plus the dated exceptions in .trivyignore. Publication uses native ARM64 images for Fargate and Lambda. Existing tags are inspected and reused instead of overwritten. The publish summary includes digests for traceability.

The pipeline sets provenance: false; do not claim signed build provenance or an attestation verification gate. A production improvement would scan the exact published digest and verify its approved origin before promotion. That introduces policy and key-management work as well as a tool choice. Exceptions also need owners and expiry review; a passing scan means the configured policy passed at that time, not that the image has no vulnerabilities.

Counter-questions

Can a new advisory make the same image unsafe tomorrow?

Yes. Vulnerability knowledge changes without an image change. Re-scanning retained and running digests is a separate operational concern.

Why mention architecture?

CI scan images and published ARM64 images are separate builds. Platform-specific layers or dependencies can differ.

Would you refuse every vulnerability?

Set severity, exploitability and fixability policy, with reviewed temporary exceptions. An indiscriminate gate can encourage untracked bypasses.

Where in MiniTickets

Read the path chapter, select the relevant map piece →, then inspect infra/src/registry.ts → createRegistry. Work through the related case for a diagnostic example.