donghyeon.kang/clean-architecture-frontend-template
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix: harden provider and promotion evidence

Browse Source
This commit is contained in:
DongHyeonka
2026-08-02 16:28:24 +09:00
parent 42ffb79997
commit 30ceac23c1
29 changed files with 3961 additions and 1076 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/ci/gates.json
+62 -33
View File
@@ -2180,6 +2180,7 @@
"artifacts/release/sbom.cdx.json",
"artifacts/security/dependency-diff.json",
"artifacts/security/license-report.json",
"artifacts/security/local-evidence-assessment.json",
"artifacts/security/scan.sarif",
"artifacts/security/supply-chain-coherence.json",
"artifacts/security/supply-chain-verification.json",
@@ -2220,12 +2221,24 @@
"value": ".release/vulnerability-candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz"
},
{
"name": "CANDIDATE_DIST_SHA256",
"value": "${{ needs.immutable_build.outputs.dist_sha256 }}"
"name": "CI_RUN_ID",
"value": "${{ gitea.run_id }}"
},
{
"name": "CANDIDATE_LOCKFILE_PATH",
"value": ".release/verified-vulnerability/pnpm-lock.yaml"
"name": "CI_RUN_ATTEMPT",
"value": "${{ gitea.run_attempt }}"
},
{
"name": "EXPECTED_SOURCE_REVISION",
"value": "${{ gitea.sha }}"
},
{
"name": "VULNERABILITY_PUBLIC_KEY_PATH",
"value": "${{ vars.VULNERABILITY_PUBLIC_KEY_PATH }}"
},
{
"name": "VULNERABILITY_KEY_ID",
"value": "${{ vars.VULNERABILITY_KEY_ID }}"
},
{
"name": "VULNERABILITY_PROVIDER_COMMAND",
@@ -2255,14 +2268,10 @@
"transferId": "release-candidate",
"path": ".release/vulnerability-candidate"
},
{
"kind": "extract",
"archivePath": ".release/vulnerability-candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz",
"targetRoot": ".release/verified-vulnerability"
},
{
"kind": "run-provider",
"provider": "vulnerability"
"provider": "vulnerability",
"stepId": "supervise_vulnerability"
},
{
"kind": "validate-provider-evidence",
@@ -2299,12 +2308,24 @@
"value": ".release/provenance-candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz"
},
{
"name": "CANDIDATE_DIST_SHA256",
"value": "${{ needs.immutable_build.outputs.dist_sha256 }}"
"name": "CI_RUN_ID",
"value": "${{ gitea.run_id }}"
},
{
"name": "CANDIDATE_LOCKFILE_PATH",
"value": ".release/verified-provenance/pnpm-lock.yaml"
"name": "CI_RUN_ATTEMPT",
"value": "${{ gitea.run_attempt }}"
},
{
"name": "EXPECTED_SOURCE_REVISION",
"value": "${{ gitea.sha }}"
},
{
"name": "PROVENANCE_PUBLIC_KEY_PATH",
"value": "${{ vars.PROVENANCE_PUBLIC_KEY_PATH }}"
},
{
"name": "PROVENANCE_KEY_ID",
"value": "${{ vars.PROVENANCE_KEY_ID }}"
},
{
"name": "PROVENANCE_PROVIDER_COMMAND",
@@ -2334,14 +2355,10 @@
"transferId": "release-candidate",
"path": ".release/provenance-candidate"
},
{
"kind": "extract",
"archivePath": ".release/provenance-candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz",
"targetRoot": ".release/verified-provenance"
},
{
"kind": "run-provider",
"provider": "provenance"
"provider": "provenance",
"stepId": "supervise_provenance"
},
{
"kind": "validate-provider-evidence",
@@ -2380,8 +2397,12 @@
"value": ".release/candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz"
},
{
"name": "CANDIDATE_ROOT",
"value": "${{ gitea.workspace }}/.release/verified-candidate"
"name": "CI_RUN_ID",
"value": "${{ gitea.run_id }}"
},
{
"name": "CI_RUN_ATTEMPT",
"value": "${{ gitea.run_attempt }}"
},
{
"name": "VULNERABILITY_REPORT_PATH",
@@ -2406,6 +2427,14 @@
{
"name": "PROVENANCE_KEY_ID",
"value": "${{ vars.PROVENANCE_KEY_ID }}"
},
{
"name": "VULNERABILITY_INVOCATION_NONCE",
"value": "${{ needs.vulnerability_provider.outputs.invocation_nonce }}"
},
{
"name": "PROVENANCE_INVOCATION_NONCE",
"value": "${{ needs.provenance_provider.outputs.invocation_nonce }}"
}
],
"steps": [
@@ -2434,24 +2463,24 @@
"path": ".release/provenance"
},
{
"kind": "extract",
"archivePath": ".release/candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz",
"targetRoot": ".release/verified-candidate"
},
{
"kind": "verify-promotion"
"kind": "verify-promotion",
"stepId": "finalize"
},
{
"kind": "upload",
"transferId": "promoted-release",
"name": "promoted-release-${{ gitea.run_id }}-${{ gitea.run_attempt }}",
"paths": [
".release/promoted-staging/release-candidate.tar.gz",
".release/promoted-staging/vulnerability-report.json",
".release/promoted-staging/provenance-attestation.json",
".release/promoted-staging/provider-verification.json",
".release/promoted-staging/promotion-verification.json"
"${{ steps.finalize.outputs.staging_root }}/release-candidate.tar.gz",
"${{ steps.finalize.outputs.staging_root }}/vulnerability-report.json",
"${{ steps.finalize.outputs.staging_root }}/provenance-attestation.json",
"${{ steps.finalize.outputs.staging_root }}/provider-verification.json",
"${{ steps.finalize.outputs.staging_root }}/promotion-verification.json"
]
},
{
"kind": "cleanup-promotion",
"finalizerStepId": "finalize"
}
]
},