[kylos101]

Description

Document the BuildKit fork's three-phase maintenance flow: select the desired upstream version, prepare a local candidate and share its diff for human review, then update remote custom-mirror only after explicit approval. Preserve Gitpod's patches and required release-branch security fixes.

Keep the parent CVE skill focused on Bob's dependency on the fork, with the detailed procedure in cve-mitigation/references/buildkit.md. Prefer the fork workflow's published ghcr.io/gitpod-io/buildkit image, verify its architecture, packaging, embedded source commit and scan results, and pin Bob's consumer by digest. Use manual Core Dev publication only when explicitly requested.

Check the workflow is enabled before pushing a new, authorized release tag. Distinguish successful image publication and draft release creation from test results; avoid redundant workflow dispatches. The approval flow remains mandatory.

Related Issue(s)

Related to Gitpod PR #21636 and BuildKit fork PR #1. The consumer PR now includes the BuildKit image update.

How to test

• Verified the linked fork history and the successful GHCR image/release jobs in run 39499071232.
• Pulled the published GHCR image, verified Linux amd64 and embedded commit 58f91399d, rebuilt Bob and confirmed zero Critical findings in the local image scan.
• Skill validation, Bash example syntax checks, pre-commit for the changed reference, and git diff --check pass. The approval phases and required review diff file remain unchanged.
• Publication examples were syntax checked; they were not executed as part of this documentation change.

Documentation

Internal remediation documentation only; no public documentation changes.

Preview status

gitpod:summary

Build Options

Build

• /werft with-werft
  Run the build with werft instead of GHA
• leeway-no-cache
• /werft no-test
  Run Leeway with --dont-test

Publish

• /werft publish-to-npm
• /werft publish-to-jb-marketplace

Installer

• analytics=segment
• with-dedicated-emulation
• workspace-feature-flags
  Add desired feature flags to the end of the line above, space separated

Preview Environment / Integration Tests

• /werft with-local-preview
  If enabled this will build install/preview
• /werft with-preview
• /werft with-large-vm
• /werft with-gce-vm
  If enabled this will create the environment on GCE infra
• /werft preemptible
  Saves cost. Untick this only if you're really sure you need a non-preemtible machine.
• with-integration-tests=all
  Valid options are all, workspace, webapp, ide, jetbrains, vscode, ssh. If enabled, with-preview and with-large-vm will be enabled.
• with-monitoring

/hold