build(release): bind reviewed source to SBOM and provenance evidence

[seonghobae]

Purpose

Advance release/supply-chain evidence without publishing from an unready product head. This Draft is a repository-owned foundation slice: one reviewed Rust source identity produces a deterministic binary archive, source/build hashes, SPDX JSON SBOM and machine-readable manifest; only a protected-main manual-dispatch attestation job may mint provenance/SBOM attestations.

This PR remains stacked on Rust-toolchain prerequisite #77. It is not a release or promotion vehicle and does not create a tag, GitHub Release, container image, registry object, deployment or production promotion.

Retained RED → GREEN lineage

• RED bf6ba08557b0900ef7959d8e9e2b83b0ad0f7fe9 introduced the release-evidence contract before the workflow existed.
• 5ce56d19e2c37ce1824b1d4d8657f6391387238f added source/version binding, locked quality gates, deterministic archive construction, SPDX generation and immutable action pins.
• RED 26541c9558b3c64363318e3042f787df3d019f65 proved scanning only the ELF could omit the locked dependency graph; 2bacb6c1b330e6c657195f2b77b32e9862479df6 packages Cargo manifests/toolchain beside the binary and scans that package directory.
• RED ea56a03acf747a0fc14ee85690cfce0eeeae1a56 rejected attestation authority on a PR-executable build job; c3b450ee321ff399a67d1d9d4d8d1f5ca0936b63 isolates it in a protected-main dispatch-only job.
• RED 3634074e2061c1f7b66a5de2fec0ce1e695a73e2 rejected unnecessary artifact-metadata: write; b040c878b9809a80f87d5bb52c3125512e4ba622 removed it.
• Actions RED 33806510290 exposed invalid job-level runner.temp; regression 3a34d35de477155c4bdb2d45f7f09db830f31800 and fix 1d3f5a4bd618084031f3e722804b7c61303baeb5 move runner-only paths into step/runtime scope.

Current stack and standards state — refreshed 2026-09-11 KST

Protected/default main is exact f8260f1e03836039ff9463dd99fa982e4e270c4b. Parent #77 adopted that protected auth/security baseline through ordinary reverse-direction restack #307 and is exact 1349b75b6e1441e531ebb443b32546ff707ac467.

Dependency-first restack #308 adopted that exact parent into this branch by ordinary merge without force or destructive rebase. Current exact #164 head is 5f0be7710d3d36c4847e0c2f0a39de116dcf35e7 on exact parent #77. The child-owned effective delta remains four release-evidence paths; protected auth and Rust-toolchain authority are inherited rather than copied.

The retained doctoring records SLSA v1.2 as an Approved Specification and SPDX 3.0.1 as the stable SPDX specification while 3.1-RC1 remains a release candidate. It does not infer SLSA conformance from attestation presence alone.

Exact-current execution

All predecessor execution evidence became historical after #308. Fresh exact-current CI 34569305587 is now terminal SUCCESS on unchanged 5f0be7710d3d36c4847e0c2f0a39de116dcf35e7; the earlier queued snapshot is superseded.

That success proves only the repository-owned release-evidence build/test path on this stacked child. It does not make the parent protected truth, mint provenance, or substitute for security/CodeQL/review/coverage/package/SBOM/provenance/governance evidence that becomes applicable at protected integration. Parent #77 itself now has CI/Fuzz/Security/Semgrep GREEN but required CodeQL RED at the central delegated settlement boundary, so this child must not outrun it.

Security and publication boundary

The PR-executable build job has only contents: read: it may build/test/SBOM/upload evidence but cannot mint OIDC-backed attestations. The separate protected-main dispatch job must bind requested version, protected source, manifest identity and recorded hashes before attestation. PR-side attestation is intentionally inapplicable; protected-main attestation remains unexecuted until its actual dispatch gate is met.

This slice does not close #84. Full release readiness still requires protected auth/egress/data/enforcement prerequisites, explicit exact-head owned-production coverage/rustdoc evidence, final container-filesystem SBOM and immutable OCI digest, signature/provenance verification before admission/promotion, deployment/attack evidence, migration compatibility, canary criteria, independent evidence retention, reproducibility comparison, and measured rollback/roll-forward. Fresh Wardnet GitHub Release inventory remains empty.

Keep Draft behind exact #77 until that prerequisite becomes protected truth or a verified complete successor carries it. Parent movement must be adopted non-destructively and invalidates child evidence. No self/model approval, routine administrator bypass, force push/destructive rebase, feature-branch publication, weakened gates, mutable foreign-owner dependency, or predecessor-evidence reuse. PR #130 remains the sole product-gap-baseline writer.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Review-driven release-boundary repair on the current lineage:

• Finding verification: the original single release-evidence job granted id-token: write, attestations: write, and artifact-metadata: write even on pull_request, while also executing PR-controlled Rust/build-script code. Step-level if: workflow_dispatch on actions/attest did not remove the OIDC/attestation authority from the PR-executable job.
• Hostile RED ea56a03acf747a0fc14ee85690cfce0eeeae1a56 adds an executable workflow contract requiring the PR build job to have no attestation authority and requiring a separate protected-main-only attestation job.
• Minimal GREEN/current c3b450ee321ff399a67d1d9d4d8d1f5ca0936b63 leaves the build/evidence job at contents: read, exports only source/version identity, uploads the exact evidence bundle, and moves OIDC/attestation permissions into attest-release-evidence, gated to workflow_dispatch after the protected-main/version checks. That job downloads the exact SHA-named artifact using immutable actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8.0.1), revalidates protected main, requested version, manifest source/version and all recorded artifact SHA-256 values before calling actions/attest.

This head supersedes 2bacb6c...; predecessor checks/reviews do not transfer. The branch remains Draft and stacked on #77. Exact-current-head execution is required before any further integration.

[seonghobae]

Fresh execution on unchanged exact child 5f0be7710d3d36c4847e0c2f0a39de116dcf35e7 has settled: CI 34569305587 is terminal SUCCESS. No additional PR-triggered Wardnet workflows materialized for this exact release-evidence path set in the current workflow inventory; do not manufacture them with no-op source churn.

The parent remains exact #77 1349b75b6e1441e531ebb443b32546ff707ac467. Parent repository/security lanes are now terminal GREEN except delegated CodeQL, whose exact current settlement failure was handed to .github#1929 comment 5630606713. Keep #164 Draft behind #77. This CI result proves only the current child source/tests; it does not mint protected-main attestations, package/SBOM/provenance publication authority, or transfer parent evidence.