fix: promote immutable verified release bundles
This commit is contained in:
DongHyeonka
@@ -88,7 +88,6 @@ jobs:
|
||||
include:
|
||||
- { gate: FE-GATE-012, name: bundle, browser: false }
|
||||
- { gate: FE-GATE-014, name: config-compatibility, browser: false }
|
||||
- { gate: FE-GATE-015, name: release-coherence, browser: false }
|
||||
- { gate: FE-GATE-019, name: hosting-header, browser: false }
|
||||
- { gate: FE-GATE-026, name: lab-performance, browser: true }
|
||||
steps:
|
||||
@@ -113,9 +112,171 @@ jobs:
|
||||
path: artifacts/
|
||||
if-no-files-found: error
|
||||
|
||||
immutable_build:
|
||||
name: FE-GATE-015 / immutable-release-candidate
|
||||
needs: release_gate
|
||||
if: ${{ startsWith(gitea.ref, 'refs/tags/v') || (gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'release' || inputs.stage == 'production' || inputs.stage == 'field')) }}
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 45
|
||||
outputs:
|
||||
dist_sha256: ${{ steps.candidate.outputs.dist_sha256 }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version-file: .nvmrc
|
||||
- name: Frozen install
|
||||
run: |
|
||||
corepack enable
|
||||
corepack pnpm install --frozen-lockfile
|
||||
- name: Build candidate once and verify local evidence
|
||||
run: corepack pnpm ci:gate -- FE-GATE-015
|
||||
- name: Archive the exact candidate file set
|
||||
id: candidate
|
||||
run: |
|
||||
mkdir -p .release
|
||||
tar --sort=name --mtime="@0" --owner=0 --group=0 --numeric-owner -czf ".release/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz" \
|
||||
dist \
|
||||
artifacts/performance/bundle.json \
|
||||
artifacts/quality/vite-module-inventory.json \
|
||||
artifacts/release/build-manifest.json \
|
||||
artifacts/release/checksums.txt \
|
||||
artifacts/release/dependency-inventory.json \
|
||||
artifacts/release/provenance.json \
|
||||
artifacts/release/release-candidate.json \
|
||||
artifacts/release/verification.json \
|
||||
artifacts/release/sbom.cdx.json \
|
||||
artifacts/security/dependency-diff.json \
|
||||
artifacts/security/license-report.json \
|
||||
artifacts/security/scan.sarif \
|
||||
artifacts/security/supply-chain-coherence.json \
|
||||
artifacts/security/supply-chain-verification.json \
|
||||
artifacts/security/vulnerability-report.json
|
||||
node -e "const m=require('./artifacts/release/release-candidate.json'); process.stdout.write('dist_sha256='+m.distSha256+'\\n')" >> "$GITHUB_OUTPUT"
|
||||
- name: Upload immutable candidate archive
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}
|
||||
path: .release/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz
|
||||
if-no-files-found: error
|
||||
|
||||
vulnerability_provider:
|
||||
name: external-vulnerability-provider
|
||||
needs: immutable_build
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 45
|
||||
env:
|
||||
CANDIDATE_DIST_SHA256: ${{ needs.immutable_build.outputs.dist_sha256 }}
|
||||
VULNERABILITY_PROVIDER_COMMAND: ${{ vars.VULNERABILITY_PROVIDER_COMMAND }}
|
||||
VULNERABILITY_REPORT_PATH: provider-evidence/vulnerability-report.json
|
||||
steps:
|
||||
- name: Download immutable candidate archive
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}
|
||||
path: .release/vulnerability-candidate
|
||||
- name: Extract the provider input candidate
|
||||
run: tar -xzf ".release/vulnerability-candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz"
|
||||
- name: Run configured external vulnerability provider
|
||||
run: |
|
||||
test -n "$VULNERABILITY_PROVIDER_COMMAND"
|
||||
mkdir -p provider-evidence
|
||||
sh -eu -c "$VULNERABILITY_PROVIDER_COMMAND"
|
||||
test -s "$VULNERABILITY_REPORT_PATH"
|
||||
- name: Upload external vulnerability report
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: vulnerability-provider-${{ gitea.run_id }}-${{ gitea.run_attempt }}
|
||||
path: provider-evidence/vulnerability-report.json
|
||||
if-no-files-found: error
|
||||
|
||||
provenance_provider:
|
||||
name: external-provenance-provider
|
||||
needs: immutable_build
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 45
|
||||
env:
|
||||
CANDIDATE_DIST_SHA256: ${{ needs.immutable_build.outputs.dist_sha256 }}
|
||||
PROVENANCE_PROVIDER_COMMAND: ${{ vars.PROVENANCE_PROVIDER_COMMAND }}
|
||||
PROVENANCE_ATTESTATION_PATH: provider-evidence/provenance-attestation.json
|
||||
steps:
|
||||
- name: Download immutable candidate archive
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}
|
||||
path: .release/provenance-candidate
|
||||
- name: Extract the provider input candidate
|
||||
run: tar -xzf ".release/provenance-candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz"
|
||||
- name: Run configured external provenance provider
|
||||
run: |
|
||||
test -n "$PROVENANCE_PROVIDER_COMMAND"
|
||||
mkdir -p provider-evidence
|
||||
sh -eu -c "$PROVENANCE_PROVIDER_COMMAND"
|
||||
test -s "$PROVENANCE_ATTESTATION_PATH"
|
||||
- name: Upload external provenance attestation
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: provenance-provider-${{ gitea.run_id }}-${{ gitea.run_attempt }}
|
||||
path: provider-evidence/provenance-attestation.json
|
||||
if-no-files-found: error
|
||||
|
||||
promotion:
|
||||
name: promote-verified-immutable-candidate
|
||||
needs: [immutable_build, vulnerability_provider, provenance_provider]
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 45
|
||||
env:
|
||||
VULNERABILITY_REPORT_PATH: .release/vulnerability/vulnerability-report.json
|
||||
PROVENANCE_ATTESTATION_PATH: .release/provenance/provenance-attestation.json
|
||||
VULNERABILITY_PUBLIC_KEY_PATH: ${{ vars.VULNERABILITY_PUBLIC_KEY_PATH }}
|
||||
VULNERABILITY_KEY_ID: ${{ vars.VULNERABILITY_KEY_ID }}
|
||||
PROVENANCE_PUBLIC_KEY_PATH: ${{ vars.PROVENANCE_PUBLIC_KEY_PATH }}
|
||||
PROVENANCE_KEY_ID: ${{ vars.PROVENANCE_KEY_ID }}
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version-file: .nvmrc
|
||||
- name: Frozen install
|
||||
run: |
|
||||
corepack enable
|
||||
corepack pnpm install --frozen-lockfile
|
||||
- name: Download immutable candidate archive
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}
|
||||
path: .release/candidate
|
||||
- name: Download vulnerability provider evidence
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: vulnerability-provider-${{ gitea.run_id }}-${{ gitea.run_attempt }}
|
||||
path: .release/vulnerability
|
||||
- name: Download provenance provider evidence
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: provenance-provider-${{ gitea.run_id }}-${{ gitea.run_attempt }}
|
||||
path: .release/provenance
|
||||
- name: Extract unchanged candidate
|
||||
run: tar -xzf ".release/candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz"
|
||||
- name: Verify provider signatures and candidate digests
|
||||
run: |
|
||||
corepack pnpm verify:provider-evidence
|
||||
corepack pnpm verify:promotion
|
||||
- name: Upload promoted unchanged candidate
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: promoted-release-${{ gitea.run_id }}-${{ gitea.run_attempt }}
|
||||
path: |
|
||||
.release/candidate/release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}.tar.gz
|
||||
.release/vulnerability/vulnerability-report.json
|
||||
.release/provenance/provenance-attestation.json
|
||||
artifacts/security/provider-verification.json
|
||||
artifacts/security/promotion-verification.json
|
||||
if-no-files-found: error
|
||||
|
||||
production_gate:
|
||||
name: ${{ matrix.gate }} / ${{ matrix.name }}
|
||||
needs: release_gate
|
||||
needs: promotion
|
||||
if: ${{ gitea.event_name == 'workflow_dispatch' && (inputs.stage == 'production' || inputs.stage == 'field') }}
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 45
|
||||
|
||||
Reference in New Issue
Block a user