release: attest exact sealed SBOM evidence - #797
Conversation
|
@opencode-agent Implement the bounded GREEN slice for exact current RED head The permanent exact-head RED workflow is valid:
Implement the organization-owned exact-artifact SBOM attestation boundary without changing reviewer identities, model credentials, existing review workflows, protected refs, release jobs, or package publication. Allowed permanent paths
Do not add temporary, one-shot, self-modifying, branch-writing, repair, generated-patch, encoded-payload, or model-executing workflows. Reusable workflow contractCreate Keep the workflow-level token read-only. Scope the credentialed attestation job to the reviewed minimum: permissions:
contents: read
id-token: write
attestations: write
artifact-metadata: writeDo not grant package, release, pull-request, issue, ref, workflow, security-event, or repository-content write authority. Do not use Checkout the trusted verifier only from the immutable called-workflow identity: repository: ${{ job.workflow_repository }}
ref: ${{ job.workflow_sha }}
persist-credentials: falseUse a separate trusted-control-plane path. Never checkout the caller repository, caller source SHA, a mutable central branch/tag, or downloaded evidence as executable source. Download only the explicitly named same-run sealed evidence artifact into a separate untrusted-data path with an immutable official action pin. Verify the caller-supplied artifact digest against trusted GitHub artifact metadata or a cryptographically equivalent fail-closed receipt; GitHub's warning-only digest behavior must not be treated as success. If the platform does not expose a trustworthy exact digest without broadening privileges, fail closed and document the required caller receipt rather than silently weakening the contract. Trusted verifierImplement Before any attestation, require:
The verifier must expose a narrow documented CLI and be independently testable without OIDC or GitHub APIs. Signing and verificationUse immutable Capture each action's
Use GitHub CLI attestation verification only as a verifier; it must not publish, create releases, move refs, or mutate repository contents. Offline evidenceCreate a deterministic offline-verification directory containing at least:
Upload this evidence with an immutable official action pin and finite retention. Keep wheel and sdist as the only package-manager publication inputs; SBOMs and bundles are evidence, not packages. Quality gatesExtend
Do not weaken existing central full-test coverage or security gates to make this slice pass. DocumentationWrite
Update |
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (7)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
@opencode-agent The exact current RED head advanced to The refinement closes the artifact-archive identity gap without granting extra authority to the OIDC signer:
No production, workflow, permission, or documentation implementation was added in this commit. Preserve the earlier immutable RED run and reproduce a new exact-current-head RED result before GREEN implementation. All other requirements in comment |
|
@opencode-agent Fix only the two exact-current-head test-contract failures on Root causes are confirmed from Exact Artifact SBOM Attestation Quality run
Modify only:
Run the focused contracts, complete verifier statement/branch coverage at 100%, public docstrings, Python 3.10 compilation, complete central test suite, and all current security checks. Do not modify production verifier code, reusable or quality workflows, doctoring, CHANGELOG, dependencies, credentials, permissions, refs, signing/attestation behavior, release/publication behavior, or any other path. Keep the PR draft and unmerged; report the new exact head and verification evidence. |
|
Release blocker: current exact scope contains three branch-repair/finalizer workflows ( @opencode-agent address Delete every finalizer, trigger, repair, materializer, source-snapshot, encoded-patch, and branch-writing workflow from the final tree. Publish the reusable attestation workflow, verifier, permanent quality workflow, tests, APA 7 doctoring, and direct CHANGELOG update through ordinary reviewed commits only. Preserve the intended trust contract:
Update the stale PR body to the actual current head and final permanent file set. Prove the permanent RED contract against protected main and GREEN after the ordinary implementation. Require Python 3.10/3.14, complete central tests, verifier 100% statement/branch/docstrings, compilation, all security/supply-chain checks, current-head CodeRabbit/OpenCode/Noema, zero valid threads, and qualifying non-author approval before Ready. |
|
@jules Fix exact current head Exact failing evidence: quality run After GREEN, remove all transient PR repair/finalizer workflows from the final diff:
Retain only the permanent reusable signing workflow, permanent quality workflow, verifier, tests, APA 7 doctoring, and authoritative CHANGELOG material. Then run Python 3.10 compilation, Python 3.14 focused and complete central tests, 100% verifier statement/branch coverage, interrogate 100%, compileall, workflow syntax, security and supply-chain checks. Commit normally; no amend, force-push, Ready transition, approval, merge, release, OIDC/permission broadening, action-pin change, or protection change. Stop without mutation if the live head differs before writing. |
|
@opencode-agent @cwl-noema-review @coderabbitai review Review-only request for exact current head |
Rate Limit Exceeded
|
|
@coderabbitai review Final read-only exact-head review for |
Rate Limit Exceeded
|
|
@opencode-agent review Review exact head |
|
@cwl-noema-review review Independently review exact head |
|
Implement the smallest coherent GREEN change for the exact current RED SBOM-attestation contract without rewriting fail-first history. Add a workflow_call-only reusable signing boundary with explicit repository/source SHA, sealed-artifact reference/digest, wheel/sdist/SBOM filenames and digests, source-identity/checksum digests, CycloneDX schema and predicate inputs; bind helper checkout to immutable job.workflow_repository/job.workflow_sha; grant only contents:read, id-token:write, attestations:write and artifact-metadata:write; treat downloaded artifacts as inert bounded data; independently verify exact six-file cardinality, digests, strict JSON, CycloneDX 1.7, root binding and handoff semantics before one actions/attest call per canonical distribution; verify resulting attestations and export offline Sigstore bundles. Require Python 3.10/3.14, complete central tests, 100% verifier statement/branch/docstrings, security/supply-chain gates, operator rollback/incident docs and APA 7 references. Do not merge, release, publish packages, use COPILOT_GITHUB_TOKEN, or alter protections. |
|
Review-only exact-head request for |
|
@cwl-noema-review Independently review exact head |
|
@opencode-agent review Perform a read-only independent review of exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== HEAD and status =='
git rev-parse HEAD
git status --short
echo '== Base commit availability =='
git cat-file -t e6fc91416c4fb13febd07b985c6e9c74fe888306
echo '== Name-status diff from protected main =='
git diff --name-status e6fc91416c4fb13febd07b985c6e9c74fe888306..HEAD
echo '== Changed workflow paths =='
git diff --name-only e6fc91416c4fb13febd07b985c6e9c74fe888306..HEAD -- .github/workflows
echo '== Candidate files =='
fd -a -t f -E .git \
'^(exact-artifact-sbom-attestation(\-quality)?\.yml|verify_exact_artifact_sbom_handoff\.py|test_exact_artifact_sbom_.*\.py|exact-artifact-sbom-attestation\.md|CHANGELOG\.md)$' .
echo '== Workflow structural outlines =='
ast-grep outline .github/workflows/exact-artifact-sbom-attestation.yml --items all || true
ast-grep outline .github/workflows/exact-artifact-sbom-attestation-quality.yml --items all || true
echo '== Verifier outline =='
ast-grep outline scripts/ci/verify_exact_artifact_sbom_handoff.py --items all || trueLength of output: 3760 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Reusable workflow =='
cat -n .github/workflows/exact-artifact-sbom-attestation.yml
echo '== Quality workflow =='
cat -n .github/workflows/exact-artifact-sbom-attestation-quality.yml
echo '== Verifier: complete implementation =='
cat -n scripts/ci/verify_exact_artifact_sbom_handoff.py
echo '== Targeted prohibited-operation and authority search =='
rg -n -i -C2 \
'(subprocess|os\.system|os\.popen|eval\s*\(|exec\s*\(|__import__|importlib|tarfile|zipfile|shutil\.unpack_archive|pip\s|python\s+-m\s+pip|npm\s|docker|gh\s+(release|pr|api.*(POST|PATCH)|workflow\s+run)|git\s+(push|tag|commit|merge)|contents:\s*write|packages:\s*write|pull-requests:\s*write|issues:\s*write|actions:\s*write|secrets:\s*inherit|COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY)' \
.github/workflows/exact-artifact-sbom-attestation.yml \
scripts/ci/verify_exact_artifact_sbom_handoff.py \
docs/doctoring/exact-artifact-sbom-attestation.md \
CHANGELOG.md || true
echo '== All action references in permanent workflows =='
rg -n -C1 '^\s*uses:\s*' .github/workflows/exact-artifact-sbom-attestation*.yml
echo '== Attestation and download/upload call counts =='
rg -n -C2 'actions/(attest|download-artifact|upload-artifact)@|gh attestation (verify|trusted-root)' \
.github/workflows/exact-artifact-sbom-attestation*.ymlLength of output: 45625 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Contract tests =='
cat -n tests/test_exact_artifact_sbom_attestation_contract.py
echo '== Verifier hostile-input tests =='
cat -n tests/test_verify_exact_artifact_sbom_handoff.py
echo '== Doctoring =='
cat -n docs/doctoring/exact-artifact-sbom-attestation.md
echo '== Required-control terms across permanent files =='
rg -n -i -C2 \
'(NaN|Infinity|parse_constant|serialNumber|UUID|uuidv5|filename.*propert|properties|document version|checksum manifest|SHA256SUMS|offline.*command|trusted.root|rollback|incident|SLSA)' \
.github/workflows/exact-artifact-sbom-attestation.yml \
scripts/ci/verify_exact_artifact_sbom_handoff.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_verify_exact_artifact_sbom_handoff.py \
docs/doctoring/exact-artifact-sbom-attestation.md
echo '== All workflow triggers and potential branch-write commands in final tree =='
rg -n -i -C2 \
'(^\s*(pull_request_target|workflow_dispatch|schedule|push|pull_request|workflow_call):|git\s+(push|commit|tag|merge)|gh\s+(pr|release|api|workflow)|contents:\s*write|pull-requests:\s*write|issues:\s*write|actions:\s*write|packages:\s*write)' \
.github/workflowsLength of output: 124693
The workflow scope and trust separation are correct. The workflow is I cannot approve this head because the following actionable defects remain.
I did not approve the pull request. Action performedReview triggered.
|
|
@coderabbitai review Final read-only review for exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head='5295b562859b3e6d3a6d59446a45f2880882c7ca'
base='e6fc91416c4fb13febd07b985c6e9c74fe888306'
echo '== Exact head =='
git rev-parse HEAD
git status --short
test "$(git rev-parse HEAD)" = "$expected_head"
echo '== Diff scope from protected main =='
git diff --name-status "$base..HEAD"
echo '== Candidate file outlines =='
ast-grep outline .github/workflows/exact-artifact-sbom-attestation.yml --items all || true
ast-grep outline scripts/ci/verify_exact_artifact_sbom_handoff.py --items all || true
ast-grep outline tests/test_verify_exact_artifact_sbom_handoff.py --items all || true
echo '== Workflow trigger, permissions, actions, checkout, and verification commands =='
rg -n -C3 \
'(^on:|workflow_call|permissions:|contents:|id-token:|attestations:|artifact-metadata:|actions:|repository:|ref:|persist-credentials:|uses:|actions/attest@|download-artifact@|upload-artifact@|gh attestation|SHA256|offline)' \
.github/workflows/exact-artifact-sbom-attestation.yml
echo '== Verifier safeguards and CycloneDX semantics =='
rg -n -C4 \
'(json\.loads|parse_constant|NaN|Infinity|lstat|symlink|is_symlink|resolve|SHA256SUMS|serialNumber|uuid|version|bomFormat|specVersion|properties|filename|manifest|subprocess|tarfile|zipfile|import |exec\(|eval\()' \
scripts/ci/verify_exact_artifact_sbom_handoff.py
echo '== Contract coverage for safeguards =='
rg -n -C2 \
'(NaN|Infinity|symlink|ancestor|serialNumber|uuid|version|filename.property|offline|SHA256SUMS)' \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_verify_exact_artifact_sbom_handoff.py
echo '== Transient workflow candidates =='
fd -a -t f . .github/workflows | rg -i '(finalize|repair|trigger|materializ|snapshot|patch)'Length of output: 28752
I cannot approve this pull request. Four actionable defects remain.
The workflow has the required call-only trigger, immutable verifier checkout, intake/signer permission separation, and two pinned Action performedReview triggered.
|
1 participant
Purpose
Add an organization-owned reusable SBOM attestation boundary for exact sealed wheel and source-distribution evidence, required by #783 and
ContextualWisdomLab/EgressWeave#46.Exact implementation head
Current exact head:
5295b562859b3e6d3a6d59446a45f2880882c7ca.The final product diff contains only permanent implementation, quality, test, doctoring, and changelog files. All branch-local repair workflows, triggers, and encoded patch machinery were removed.
Trust boundary
workflow_callwith explicit required source, artifact, digest, filename, schema, and predicate inputs.${{ job.workflow_repository }}and${{ job.workflow_sha }}rather than caller-controlled source.contents: read,id-token: write,attestations: write, andartifact-metadata: write.actions/attestaction exactly once for the wheel and once for the sdist.Test-first verification
The final exact-head verifier run completed:
39focused contract and hostile-input tests;197/197;70/70;100%; andPython 3.10 compatibility is retained by the permanent quality workflow.
docs/doctoring/exact-artifact-sbom-attestation.mdrecords lifecycle, trust boundary, offline verification, incident recovery, rollback, nonclaims, and APA 7th primary sources.CHANGELOG.mdrecords the capability under Unreleased.Merge gate
Merge only after every required exact-current-head quality, security, supply-chain, CodeRabbit, OpenCode, Noema, independent non-author approval, unresolved-thread, and branch-protection gate succeeds without bypass.
Progresses #783.
Summary by CodeRabbit
새로운 기능
문서
품질 개선