fix: promote immutable verified release bundles

scripts/verify-supply-chain-promotion.ts

@@ -1,29 +1,19 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { mkdir } from "node:fs/promises";
 
-const verification = JSON.parse(
-  await readFile(
-    "artifacts/security/supply-chain-verification.json",
-    "utf8",
-  ),
-);
-const passed = verification.promotionStatus === "PASS";
-const report = {
-  schemaVersion: 1,
-  status: passed ? "PASS" : "FAIL_UNVERIFIED",
-  vulnerabilityStatus: verification.vulnerabilityStatus,
-  provenanceAttestationStatus:
-    verification.provenanceAttestationStatus,
-  lockfileSha256: verification.lockfileSha256,
-  distSha256: verification.distSha256,
-};
+import { providerVerificationArtifactSchema } from "./lib/provider-evidence.ts";
+import { verifyPromotionInputs } from "./lib/promotion-verifier.ts";
+import { writeValidatedJsonArtifact } from "./lib/validated-json-artifact.ts";
+
+const report = await verifyPromotionInputs();
 await mkdir("artifacts/security", { recursive: true });
-await writeFile(
-  "artifacts/security/promotion-verification.json",
-  `${JSON.stringify(report, null, 2)}\n`,
-);
-if (!passed) {
+await writeValidatedJsonArtifact({
+  path: "artifacts/security/promotion-verification.json",
+  schema: providerVerificationArtifactSchema,
+  value: report,
+});
+if (report.status !== "PASS") {
   process.stderr.write(
-    "Supply-chain promotion is FAIL_UNVERIFIED: external vulnerability and signed provenance evidence are required.\n",
+    `Supply-chain promotion is FAIL_UNVERIFIED:\n- ${report.failures.join("\n- ")}\n`,
   );
   process.exit(1);
 }