fix: close immutable promotion trust gaps

2026-08-02 06:39:41 +09:00
parent 7c5ed80407
commit 92e5cace5c
16 changed files with 1228 additions and 274 deletions
@@ -191,8 +191,14 @@ for (const requiredToken of [
  'CI_RUNNER_IMAGE: "${{ vars.RUNNER_IMAGE_DIGEST }}"',
  "VULNERABILITY_REPORT_PATH:",
  "PROVENANCE_ATTESTATION_PATH:",
+  "CANDIDATE_LOCKFILE_PATH: pnpm-lock.yaml",
+  "VULNERABILITY_PROVIDER_COMMAND:",
+  "PROVENANCE_PROVIDER_COMMAND:",
  "VULNERABILITY_PUBLIC_KEY_PATH:",
+  "VULNERABILITY_KEY_ID:",
  "PROVENANCE_PUBLIC_KEY_PATH:",
+  "PROVENANCE_KEY_ID:",
+  "            pnpm-lock.yaml \\",
  "release-candidate-${{ gitea.run_id }}-${{ gitea.run_attempt }}",
  "corepack pnpm verify:provider-evidence",
  "corepack pnpm verify:promotion",