fix: harden provider and promotion evidence

scripts/stage-verified-promotion.ts

@@ -1,4 +1,6 @@
-import { stageVerifiedPromotion } from "./lib/promotion-stager.ts";
+import { appendFile } from "node:fs/promises";
+
+import { finalizeVerifiedPromotion } from "./lib/promotion-stager.ts";
 
 const required = (name: string): string => {
   const value = process.env[name];
@@ -6,7 +8,7 @@ const required = (name: string): string => {
   return value;
 };
 
-const staged = await stageVerifiedPromotion({
+const staged = await finalizeVerifiedPromotion({
   repositoryRoot: process.cwd(),
   archivePath: required("CANDIDATE_ARCHIVE_PATH"),
   expectedArchiveSha256: required("CANDIDATE_ARCHIVE_SHA256"),
@@ -16,7 +18,27 @@ const staged = await stageVerifiedPromotion({
   vulnerabilityKeyId: required("VULNERABILITY_KEY_ID"),
   provenancePublicKeyPath: required("PROVENANCE_PUBLIC_KEY_PATH"),
   provenanceKeyId: required("PROVENANCE_KEY_ID"),
+  expectedRun: {
+    id: process.env.GITEA_RUN_ID ?? process.env.GITHUB_RUN_ID ?? required("CI_RUN_ID"),
+    attempt: Number(process.env.GITEA_RUN_ATTEMPT ?? process.env.GITHUB_RUN_ATTEMPT ?? required("CI_RUN_ATTEMPT")),
+    sourceRevision: process.env.EXPECTED_SOURCE_REVISION ?? required("VITE_COMMIT_SHA"),
+  },
+  vulnerabilityInvocationNonce: required("VULNERABILITY_INVOCATION_NONCE"),
+  provenanceInvocationNonce: required("PROVENANCE_INVOCATION_NONCE"),
+  runnerTempRoot: required("RUNNER_TEMP"),
 });
+const output = required("GITHUB_OUTPUT");
+await appendFile(
+  output,
+  [
+    `staging_root=${staged.stagingRoot}`,
+    `cleanup_token=${staged.cleanupToken}`,
+    `runner_temp_dev=${staged.runnerTempIdentity.dev}`,
+    `runner_temp_ino=${staged.runnerTempIdentity.ino}`,
+    "",
+  ].join("\n"),
+  { encoding: "utf8" },
+);
 process.stdout.write(
-  `Promotion staging: ${staged.map(({ path, sha256 }) => `${path}=${sha256}`).join(", ")} PASS\n`,
+  `Promotion staging: ${staged.files.map(({ name, sha256 }) => `${name}=${sha256}`).join(", ")} PASS\n`,
 );