refactor: generate CI workflow from gate contracts

scripts/check-supply-chain-provider-fixtures.ts

@@ -35,6 +35,7 @@ try {
     ),
   );
   const actualDefaultVerifier = await verifyPromotionInputs({
+    artifactType: "provider-verification",
     environment: actualProviderEnvironment,
   });
 
@@ -83,16 +84,19 @@ try {
   });
   const fixtures = {
     absent: await verifyPromotionInputs({
+      artifactType: "provider-verification",
       repositoryRoot: fixtureRoot,
       environment: {},
       verifyLocalEvidence: acceptLocalEvidence,
     }),
     validImmutable: await verifyPromotionInputs({
+      artifactType: "provider-verification",
       repositoryRoot: fixtureRoot,
       environment: validEnvironment,
       verifyLocalEvidence: acceptLocalEvidence,
     }),
     wrongDigest: await verifyPromotionInputs({
+      artifactType: "provider-verification",
       repositoryRoot: fixtureRoot,
       environment: wrongEnvironment,
       verifyLocalEvidence: acceptLocalEvidence,
@@ -103,6 +107,7 @@ try {
   };
   await writeFile(path.join(fixtureRoot, "dist/app.js"), "mutated\n");
   fixtures.postAttestationMutation = await verifyPromotionInputs({
+    artifactType: "provider-verification",
     repositoryRoot: fixtureRoot,
     environment: validEnvironment,
     verifyLocalEvidence: acceptLocalEvidence,
@@ -159,6 +164,7 @@ function absoluteProviderEnvironment(
 ): NodeJS.ProcessEnv {
   const absolute = { ...environment };
   for (const key of [
+    "CANDIDATE_ARCHIVE_PATH",
     "VULNERABILITY_REPORT_PATH",
     "PROVENANCE_ATTESTATION_PATH",
     "VULNERABILITY_PUBLIC_KEY_PATH",
@@ -204,6 +210,10 @@ async function writeProviderEnvironment(
     provenanceKeys.privateKey,
   );
   await Promise.all([
+    writeFile(
+      path.join(repositoryRoot, directory, "candidate.tar.gz"),
+      "fixture archive\n",
+    ),
     writeFile(
       path.join(repositoryRoot, directory, "vulnerability.json"),
       `${JSON.stringify(vulnerability)}\n`,
@@ -226,6 +236,10 @@ async function writeProviderEnvironment(
     ),
   ]);
   return {
+    CANDIDATE_ARCHIVE_PATH: `${directory}/candidate.tar.gz`,
+    CANDIDATE_ARCHIVE_SHA256: createHash("sha256")
+      .update("fixture archive\n")
+      .digest("hex"),
     VULNERABILITY_REPORT_PATH: `${directory}/vulnerability.json`,
     PROVENANCE_ATTESTATION_PATH: `${directory}/provenance.json`,
     VULNERABILITY_PUBLIC_KEY_PATH: `${directory}/vulnerability.pem`,