Stop app image signing after build failures

apps/website/render-static-pages.sh

@@ -10,8 +10,9 @@ render_page() {
   request_uri="$4"
 
   mkdir -p "$(dirname "$output")"
+  echo "Rendering ${source} (${lang}) -> ${output}" >&2
   # shellcheck disable=SC2016
-  php -r '
+  if php -d display_errors=stderr -d log_errors=0 -r '
     parse_str($argv[1], $_GET);
     $_SERVER["HTTP_ACCEPT_LANGUAGE"] = $argv[2];
     $_SERVER["REQUEST_METHOD"] = "GET";
@@ -19,7 +20,14 @@ render_page() {
     $_SERVER["PHP_SELF"] = "/" . $argv[4];
     chdir($argv[5]);
     include $argv[5] . "/" . $argv[4];
-  ' "lang=$lang" "$lang" "$request_uri" "$source" "$root" > "$output"
+  ' "lang=$lang" "$lang" "$request_uri" "$source" "$root" > "$output"; then
+    return 0
+  fi
+
+  status=$?
+  echo "Failed rendering ${source} (${lang}) with exit status ${status}" >&2
+  rm -f "$output"
+  return "$status"
 }
 
 for lang in en nah; do

lib/jeannie/pipeline.sh

@@ -3545,7 +3545,10 @@ publish_image_supply_chain_metadata() {
         return 0
     fi
 
-    digest_ref="$(image_digest_ref "${image_ref}")"
+    if ! digest_ref="$(image_digest_ref "${image_ref}")" || [[ -z "${digest_ref}" ]]; then
+        echo "Cannot publish supply-chain metadata because image digest resolution failed for ${image_ref}." >&2
+        return 1
+    fi
     mapfile -t registry_flags < <(cosign_registry_flags "${registry_endpoint}" "${digest_ref}")
     sbom_file="$(mktemp)"
     write_image_sbom_predicate "${digest_ref}" "${sbom_file}" "${source_hash}"
@@ -5332,7 +5335,7 @@ apps() {
             buildx_builder_ready=true
         fi
 
-        docker buildx build \
+        if ! docker buildx build \
             --network host \
             --platform "${website_platforms}" \
             --provenance=false \
@@ -5341,7 +5344,10 @@ apps() {
             -t "${website_image_ref}" \
             -f "${REPO_ROOT}/apps/website/Dockerfile" \
             "${REPO_ROOT}/apps/website/" \
-            --push
+            --push; then
+            echo "Website image build failed for ${website_image_ref}; not publishing supply-chain metadata." >&2
+            return 1
+        fi
         website_image_built=true
     fi
     publish_image_supply_chain_metadata "${website_image_ref}" "${registry_endpoint}" "${website_source_hash}"
@@ -5357,7 +5363,7 @@ apps() {
             buildx_builder_ready=true
         fi
 
-        docker buildx build \
+        if ! docker buildx build \
             --network host \
             --platform "${demos_platforms}" \
             --provenance=false \
@@ -5366,7 +5372,10 @@ apps() {
             -t "${demos_image_ref}" \
             -f "${REPO_ROOT}/apps/demos-static/Dockerfile" \
             "${REPO_ROOT}/apps/demos-static/" \
-            --push
+            --push; then
+            echo "Demos image build failed for ${demos_image_ref}; not publishing supply-chain metadata." >&2
+            return 1
+        fi
         demos_image_built=true
     fi
     publish_image_supply_chain_metadata "${demos_image_ref}" "${registry_endpoint}" "${demos_source_hash}"