Skip to content

feat(ci): fail-closed pre-publish dependency license and Strix gate (#2342) #2347

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
seonghobae wants to merge 20 commits into
base: main
Choose a base branch
from
Draft

feat(ci): fail-closed pre-publish dependency license and Strix gate (#2342) #2347

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
1379881
feat(ci): fail-closed pre-publish dependency license and Strix gate
seonghobae Sep 22, 2026
e4e188f
fix(ci): make the release dependency gate executable on a real runner
seonghobae Sep 23, 2026
3c3ca9b
fix(ci): scan only the fixture, never the trusted binder beside it
seonghobae Sep 23, 2026
65727fa
feat(ci): decide licences before credentials and compare dependency s…
seonghobae Sep 23, 2026
85f4e1d
docs(ci): record the negative-fixture verification plan and its open …
seonghobae Sep 23, 2026
cd2270f
test(ci): pin the empty-enumeration invariant and drop the guard it m…
seonghobae Sep 23, 2026
094af24
fix(ci): pin every gate subcommand to the trusted checkout and clarif…
seonghobae Sep 23, 2026
36694dc
fix(ci): validate lock source directives so capture resolves like ins…
seonghobae Sep 23, 2026
03ba177
fix(ci): adjudicate every dependency before it is installed
seonghobae Sep 23, 2026
57032f8
test(ci): cover strict base64 decoding and the non-tick scheduled run
seonghobae Sep 23, 2026
0f79832
fix(ci): make licence evidence, install binding, and the venv guard real
seonghobae Sep 23, 2026
48caafe
docs(ci): state the gate toolchain scope limit instead of implying co…
seonghobae Sep 23, 2026
4329ebb
fix(ci): verify complete reviewed license text before acceptance
seonghobae Sep 23, 2026
4fe66ef
fix(ci): register six source-bound complete license texts
seonghobae Sep 23, 2026
a78b1c9
test(ci): bind gate fixtures to complete same-license sources
seonghobae Sep 23, 2026
d4d80fd
fix(release): bind license evidence to captured archive bytes
seonghobae Sep 23, 2026
d1fa733
fix(release): namespace repeated gate diagnostic reports
seonghobae Sep 23, 2026
00c6551
test(ci): match case-insensitive report name comparison
seonghobae Sep 23, 2026
1916e95
fix(ci): verify independently pinned release helper source
seonghobae Sep 23, 2026
6e67428
fix(ci): bind release build intake to immutable artifact identity
seonghobae Sep 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
78 changes: 58 additions & 20 deletions .github/workflows/exact-artifact-sbom-attestation.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,19 +78,39 @@ jobs:
- name: Materialize immutable trusted verifier
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
# job.workflow_repository/workflow_sha are not real Actions context
# properties (actionlint-flagged); this always resolved to an empty
# repository/ref, silently defaulting checkout away from the pinned
# trusted verifier source. ContextualWisdomLab/.github is this
# workflow's own repository; github.workflow_sha is the real,
# documented property for its pinned commit.
# Independently reviewed helper snapshot, not caller/called workflow SHA.
repository: ContextualWisdomLab/.github
ref: ${{ github.workflow_sha }}
# Reviewed helper revision; intentionally distinct from workflow revision.
ref: 00c6551183cca101cfc97c43656a17cc2491c1b4
path: trusted-intake
persist-credentials: false
sparse-checkout: scripts/ci/verify_exact_artifact_sbom_handoff.py
sparse-checkout: |
scripts/ci/
requirements-strix-ci-hashes.txt
sparse-checkout-cone-mode: false

- name: Verify fixed helper checkout identity
env:
HELPER_ROOT: trusted-intake
CALLER_WORKFLOW_SHA: ${{ github.workflow_sha }}
shell: bash --noprofile --norc -e -o pipefail {0}
run: |
expected=00c6551183cca101cfc97c43656a17cc2491c1b4
test "$(git -C "$HELPER_ROOT" rev-parse HEAD)" = "$expected"
origin="$(git -C "$HELPER_ROOT" remote get-url origin)"
case "$origin" in
https://github.com/ContextualWisdomLab/.github|https://github.com/ContextualWisdomLab/.github.git) ;;
*) echo "Foreign helper repository" >&2; exit 1 ;;
esac
test "$(git -C "$HELPER_ROOT" rev-parse HEAD:scripts/ci)" = bf26d3eefdb71fe79b855d941ffb46eb432b2f76
test "$(git -C "$HELPER_ROOT" rev-parse HEAD:requirements-strix-ci-hashes.txt)" = 9e705850b5ce53c7fe836bc3df3a18771151e3f6
git -C "$HELPER_ROOT" diff --exit-code HEAD -- scripts/ci requirements-strix-ci-hashes.txt
test -f "$HELPER_ROOT/scripts/ci/release_dependency_gate.py"
test -f "$HELPER_ROOT/scripts/ci/verify_exact_artifact_sbom_handoff.py"
test -f "$HELPER_ROOT/requirements-strix-ci-hashes.txt"
printf 'helper_repository=ContextualWisdomLab/.github helper_sha=%s caller_workflow_sha=%s\n' "$expected" "$CALLER_WORKFLOW_SHA"


- name: Verify immutable same-run artifact metadata
env:
GH_TOKEN: ${{ github.token }}
Expand Down Expand Up @@ -177,19 +197,39 @@ jobs:
- name: Materialize immutable trusted verifier
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
# job.workflow_repository/workflow_sha are not real Actions context
# properties (actionlint-flagged); this always resolved to an empty
# repository/ref, silently defaulting checkout away from the pinned
# trusted verifier source. ContextualWisdomLab/.github is this
# workflow's own repository; github.workflow_sha is the real,
# documented property for its pinned commit.
# Independently reviewed helper snapshot, not caller/called workflow SHA.
repository: ContextualWisdomLab/.github
ref: ${{ github.workflow_sha }}
# Reviewed helper revision; intentionally distinct from workflow revision.
ref: 00c6551183cca101cfc97c43656a17cc2491c1b4
path: trusted-signer
persist-credentials: false
sparse-checkout: scripts/ci/verify_exact_artifact_sbom_handoff.py
sparse-checkout: |
scripts/ci/
requirements-strix-ci-hashes.txt
sparse-checkout-cone-mode: false

- name: Verify fixed helper checkout identity
env:
HELPER_ROOT: trusted-signer
CALLER_WORKFLOW_SHA: ${{ github.workflow_sha }}
shell: bash --noprofile --norc -e -o pipefail {0}
run: |
expected=00c6551183cca101cfc97c43656a17cc2491c1b4
test "$(git -C "$HELPER_ROOT" rev-parse HEAD)" = "$expected"
origin="$(git -C "$HELPER_ROOT" remote get-url origin)"
case "$origin" in
https://github.com/ContextualWisdomLab/.github|https://github.com/ContextualWisdomLab/.github.git) ;;
*) echo "Foreign helper repository" >&2; exit 1 ;;
esac
test "$(git -C "$HELPER_ROOT" rev-parse HEAD:scripts/ci)" = bf26d3eefdb71fe79b855d941ffb46eb432b2f76
test "$(git -C "$HELPER_ROOT" rev-parse HEAD:requirements-strix-ci-hashes.txt)" = 9e705850b5ce53c7fe836bc3df3a18771151e3f6
git -C "$HELPER_ROOT" diff --exit-code HEAD -- scripts/ci requirements-strix-ci-hashes.txt
test -f "$HELPER_ROOT/scripts/ci/release_dependency_gate.py"
test -f "$HELPER_ROOT/scripts/ci/verify_exact_artifact_sbom_handoff.py"
test -f "$HELPER_ROOT/requirements-strix-ci-hashes.txt"
printf 'helper_repository=ContextualWisdomLab/.github helper_sha=%s caller_workflow_sha=%s\n' "$expected" "$CALLER_WORKFLOW_SHA"


- name: Verify immutable same-run artifact metadata
env:
GH_TOKEN: ${{ github.token }}
Expand Down Expand Up @@ -275,9 +315,7 @@ jobs:
- name: Verify online and prepare offline bundles
env:
GH_TOKEN: ${{ github.token }}
# job.workflow_repository is not a real Actions context property
# (actionlint-flagged); ContextualWisdomLab/.github is this workflow's
# own repository, matching the pinned checkout above.
# Signer repository is fixed independently of the caller identity.
SIGNER_REPOSITORY: ContextualWisdomLab/.github
PREDICATE_TYPE: ${{ inputs.predicate_type }}
SOURCE_REPOSITORY: ${{ inputs.source_repository }}
Expand Down Expand Up @@ -400,4 +438,4 @@ jobs:
name: exact-artifact-sbom-offline-verification
path: offline-attestation-evidence
if-no-files-found: error
retention-days: 90
retention-days: 90
Loading
Loading