refactor: generate CI workflow from gate contracts

2026-08-02 13:53:25 +09:00
parent 777ce5c9ed
commit 1bb2cc4a20
45 changed files with 8599 additions and 1177 deletions
@@ -0,0 +1,22 @@
+import { stageVerifiedPromotion } from "./lib/promotion-stager.ts";
+
+const required = (name: string): string => {
+  const value = process.env[name];
+  if (!value) throw new TypeError(`promotion staging environment is missing ${name}`);
+  return value;
+};
+
+const staged = await stageVerifiedPromotion({
+  repositoryRoot: process.cwd(),
+  archivePath: required("CANDIDATE_ARCHIVE_PATH"),
+  expectedArchiveSha256: required("CANDIDATE_ARCHIVE_SHA256"),
+  vulnerabilityReportPath: required("VULNERABILITY_REPORT_PATH"),
+  provenanceAttestationPath: required("PROVENANCE_ATTESTATION_PATH"),
+  vulnerabilityPublicKeyPath: required("VULNERABILITY_PUBLIC_KEY_PATH"),
+  vulnerabilityKeyId: required("VULNERABILITY_KEY_ID"),
+  provenancePublicKeyPath: required("PROVENANCE_PUBLIC_KEY_PATH"),
+  provenanceKeyId: required("PROVENANCE_KEY_ID"),
+});
+process.stdout.write(
+  `Promotion staging: ${staged.map(({ path, sha256 }) => `${path}=${sha256}`).join(", ")} PASS\n`,
+);