refactor: 리펙토링

scripts/verify-supply-chain-artifacts.ts

@@ -8,6 +8,7 @@ import {
   supplyChainDigest,
   verifySupplyChainCoherence,
 } from "./lib/supply-chain.ts";
+import { assertMatchesJsonSchema } from "./lib/json-schema.ts";
 
 type Document = Record<string, unknown>;
 
@@ -48,6 +49,25 @@ const provenance = await readDocument("artifacts/release/provenance.json");
 const verification = await readDocument(
   "artifacts/security/supply-chain-verification.json",
 );
+const artifactSchemaFailures: string[] = [];
+for (const [schemaPath, artifact, label] of [
+  [
+    "schemas/artifacts/dependency-inventory.schema.json",
+    inventory,
+    "dependency inventory",
+  ],
+  [
+    "schemas/artifacts/supply-chain-verification.schema.json",
+    verification,
+    "supply-chain verification",
+  ],
+] as const) {
+  try {
+    assertMatchesJsonSchema(await readDocument(schemaPath), artifact, label);
+  } catch {
+    artifactSchemaFailures.push(`${label} JSON Schema mismatch`);
+  }
+}
 const lockfileText = await readFile("pnpm-lock.yaml", "utf8");
 const lockfileSha256 = createHash("sha256")
   .update(lockfileText)
@@ -69,7 +89,7 @@ const coherence = verifySupplyChainCoherence(
   provenance,
   distDigest,
 );
-const failures: string[] = [...coherence.failures];
+const failures: string[] = [...artifactSchemaFailures, ...coherence.failures];
 if (
   inventory.lockfileSha256 !== lockfileSha256 ||
   verification.lockfileSha256 !== lockfileSha256