fix: promote immutable verified release bundles

2026-08-02 06:08:06 +09:00
parent 100a3bb6ba
commit 7c5ed80407
17 changed files with 1203 additions and 263 deletions
@@ -0,0 +1,20 @@
+import { mkdir } from "node:fs/promises";
+
+import { providerVerificationArtifactSchema } from "./lib/provider-evidence.ts";
+import { verifyPromotionInputs } from "./lib/promotion-verifier.ts";
+import { writeValidatedJsonArtifact } from "./lib/validated-json-artifact.ts";
+
+const report = await verifyPromotionInputs();
+await mkdir("artifacts/security", { recursive: true });
+await writeValidatedJsonArtifact({
+  path: "artifacts/security/provider-verification.json",
+  schema: providerVerificationArtifactSchema,
+  value: report,
+});
+if (report.status !== "PASS") {
+  process.stderr.write(
+    `Provider evidence is FAIL_UNVERIFIED:\n- ${report.failures.join("\n- ")}\n`,
+  );
+  process.exit(1);
+}
+process.stdout.write("Provider evidence: PASS\n");