feat: verify frontend supply chain

2026-07-26 17:37:51 +09:00
parent a64708f3de
commit 8b4f875c1c
35 changed files with 8910 additions and 141 deletions
@@ -0,0 +1,30 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+
+const verification = JSON.parse(
+  await readFile(
+    "artifacts/security/supply-chain-verification.json",
+    "utf8",
+  ),
+);
+const passed = verification.promotionStatus === "PASS";
+const report = {
+  schemaVersion: 1,
+  status: passed ? "PASS" : "FAIL_UNVERIFIED",
+  vulnerabilityStatus: verification.vulnerabilityStatus,
+  provenanceAttestationStatus:
+    verification.provenanceAttestationStatus,
+  lockfileSha256: verification.lockfileSha256,
+  distSha256: verification.distSha256,
+};
+await mkdir("artifacts/security", { recursive: true });
+await writeFile(
+  "artifacts/security/promotion-verification.json",
+  `${JSON.stringify(report, null, 2)}\n`,
+);
+if (!passed) {
+  process.stderr.write(
+    "Supply-chain promotion is FAIL_UNVERIFIED: external vulnerability and signed provenance evidence are required.\n",
+  );
+  process.exit(1);
+}
+process.stdout.write("Supply-chain promotion evidence: PASS\n");