donghyeon.kang/clean-architecture-frontend-template
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor: derive the release identity from the package name

Browse Source 
The supply-chain builder id and the two verifier ids each hardcoded the
repository name, in three source files plus a copy in the test fixture.
A project derived from this template had to edit all four, and all four
then became permanent conflict points for every merge back from here.

They now read the `name` this repository already declares in
package.json, so deriving a project is one line. The name is read once
at module load from a URL relative to the module itself, not from the
working directory, because these ids end up in signed provenance and
must not depend on where a script was invoked from. A missing or empty
name throws rather than falling back, for the same reason.

The value is hosted in scripts/lib/supply-chain.ts because all three
consumers already import it and it is already registered in
LOCAL_EVIDENCE_VERIFIER_SOURCE_PATHS. A new module would have needed to
join that list, which is itself part of the evidence surface.

This repository's own name is unchanged, so every emitted id is
byte-identical to before.

Also registers the three adapter files that 5cc4146 added without
updating the inventory ledger, which had left check:adapter-inventory
failing on develop.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
DongHyeonka
2026-09-20 13:47:27 +09:00
co-authored by Claude Opus 5
parent 8dd7cbaea3
commit ebea300e4f
6 changed files with 112 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reviews/adapters/INVENTORY.md
+80 -77
View File
@@ -61,83 +61,86 @@
| 51 | `src/adapters/http/bounded-body-reader.ts` | [Network/state](./01-network-and-state.md) | | 51 | `src/adapters/http/bounded-body-reader.ts` | [Network/state](./01-network-and-state.md) |
| 52 | `src/adapters/http/bounded-json.ts` | [Network/state](./01-network-and-state.md) | | 52 | `src/adapters/http/bounded-json.ts` | [Network/state](./01-network-and-state.md) |
| 53 | `src/adapters/http/client.ts` | [Network/state](./01-network-and-state.md) | | 53 | `src/adapters/http/client.ts` | [Network/state](./01-network-and-state.md) |
| 54 | `src/adapters/http/http-contract-bridge.ts` | [Network/state](./01-network-and-state.md) | | 54 | `src/adapters/http/feature-http-binding.ts` | [Network/state](./01-network-and-state.md) |
| 55 | `src/adapters/http/http-effect-certainty.ts` | [Network/state](./01-network-and-state.md) | | 55 | `src/adapters/http/http-contract-bridge.ts` | [Network/state](./01-network-and-state.md) |
| 56 | `src/adapters/http/http-execution-v3.ts` | [Network/state](./01-network-and-state.md) | | 56 | `src/adapters/http/http-effect-certainty.ts` | [Network/state](./01-network-and-state.md) |
| 57 | `src/adapters/http/index.ts` | [Network/state](./01-network-and-state.md) | | 57 | `src/adapters/http/http-execution-v3.ts` | [Network/state](./01-network-and-state.md) |
| 58 | `src/adapters/http/request-builder.ts` | [Network/state](./01-network-and-state.md) | | 58 | `src/adapters/http/http-retry-lifecycle.ts` | [Network/state](./01-network-and-state.md) |
| 59 | `src/adapters/http/resource-mapper.ts` | [Network/state](./01-network-and-state.md) | | 59 | `src/adapters/http/index.ts` | [Network/state](./01-network-and-state.md) |
| 60 | `src/adapters/http/retry-policy.ts` | [Network/state](./01-network-and-state.md) | | 60 | `src/adapters/http/request-builder.ts` | [Network/state](./01-network-and-state.md) |
| 61 | `src/adapters/http/schema-registry.ts` | [Network/state](./01-network-and-state.md) | | 61 | `src/adapters/http/resource-mapper.ts` | [Network/state](./01-network-and-state.md) |
| 62 | `src/adapters/platform/abortable-operation.ts` | [Network/state](./01-network-and-state.md) | | 62 | `src/adapters/http/retry-policy.ts` | [Network/state](./01-network-and-state.md) |
| 63 | `src/adapters/platform/browser-lifecycle.ts` | [Network/state](./01-network-and-state.md) | | 63 | `src/adapters/http/schema-registry.ts` | [Network/state](./01-network-and-state.md) |
| 64 | `src/adapters/platform/browser-mutation-intent-factory.ts` | [Network/state](./01-network-and-state.md) | | 64 | `src/adapters/platform/abortable-operation.ts` | [Network/state](./01-network-and-state.md) |
| 65 | `src/adapters/platform/bounded-capacity.ts` | [Network/state](./01-network-and-state.md) | | 65 | `src/adapters/platform/bounded-capacity.ts` | [Network/state](./01-network-and-state.md) |
| 66 | `src/adapters/platform/index.ts` | [Network/state](./01-network-and-state.md) | | 66 | `src/adapters/platform/browser-lifecycle.ts` | [Network/state](./01-network-and-state.md) |
| 67 | `src/adapters/platform/indexeddb-connection.ts` | [Network/state](./01-network-and-state.md) | | 67 | `src/adapters/platform/browser-mutation-intent-factory.ts` | [Network/state](./01-network-and-state.md) |
| 68 | `src/adapters/platform/indexeddb-transaction.ts` | [Network/state](./01-network-and-state.md) | | 68 | `src/adapters/platform/index.ts` | [Network/state](./01-network-and-state.md) |
| 69 | `src/adapters/platform/system-clock.ts` | [Network/state](./01-network-and-state.md) | | 69 | `src/adapters/platform/indexeddb-connection.ts` | [Network/state](./01-network-and-state.md) |
| 70 | `src/adapters/query-cache/conditional-validator-store.ts` | [Network/state](./01-network-and-state.md) | | 70 | `src/adapters/platform/indexeddb-transaction.ts` | [Network/state](./01-network-and-state.md) |
| 71 | `src/adapters/query-cache/cursor-pagination-runtime.ts` | [Network/state](./01-network-and-state.md) | | 71 | `src/adapters/platform/system-clock.ts` | [Network/state](./01-network-and-state.md) |
| 72 | `src/adapters/query-cache/index.ts` | [Network/state](./01-network-and-state.md) | | 72 | `src/adapters/query-cache/conditional-validator-store.ts` | [Network/state](./01-network-and-state.md) |
| 73 | `src/adapters/query-cache/server-state-scope-runtime.ts` | [Network/state](./01-network-and-state.md) | | 73 | `src/adapters/query-cache/cursor-pagination-contract.ts` | [Network/state](./01-network-and-state.md) |
| 74 | `src/adapters/query-cache/tanstack-cache-coordinator.ts` | [Network/state](./01-network-and-state.md) | | 74 | `src/adapters/query-cache/cursor-pagination-runtime.ts` | [Network/state](./01-network-and-state.md) |
| 75 | `src/adapters/query-cache/tanstack-query-cache.ts` | [Network/state](./01-network-and-state.md) | | 75 | `src/adapters/query-cache/index.ts` | [Network/state](./01-network-and-state.md) |
| 76 | `src/adapters/realtime/event-codec.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 76 | `src/adapters/query-cache/server-state-scope-runtime.ts` | [Network/state](./01-network-and-state.md) |
| 77 | `src/adapters/realtime/event-consumer.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 77 | `src/adapters/query-cache/tanstack-cache-coordinator.ts` | [Network/state](./01-network-and-state.md) |
| 78 | `src/adapters/realtime/index.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 78 | `src/adapters/query-cache/tanstack-query-cache.ts` | [Network/state](./01-network-and-state.md) |
| 79 | `src/adapters/realtime/json-member-scanner.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 79 | `src/adapters/realtime/event-codec.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 80 | `src/adapters/realtime/live-poll-handoff-coordinator.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 80 | `src/adapters/realtime/event-consumer.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 81 | `src/adapters/realtime/polling/bounded-poll-coordinator.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 81 | `src/adapters/realtime/index.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 82 | `src/adapters/realtime/polling/index.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 82 | `src/adapters/realtime/json-member-scanner.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 83 | `src/adapters/realtime/reconnect-coordinator.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 83 | `src/adapters/realtime/live-poll-handoff-coordinator.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 84 | `src/adapters/realtime/reconnect-policy.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 84 | `src/adapters/realtime/polling/bounded-poll-coordinator.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 85 | `src/adapters/realtime/result.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 85 | `src/adapters/realtime/polling/index.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 86 | `src/adapters/realtime/sse/fetch-sse-connection.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 86 | `src/adapters/realtime/reconnect-coordinator.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 87 | `src/adapters/realtime/sse/index.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 87 | `src/adapters/realtime/reconnect-policy.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 88 | `src/adapters/realtime/sse/sse-parser.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 88 | `src/adapters/realtime/result.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 89 | `src/adapters/realtime/stream-coordinator.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 89 | `src/adapters/realtime/sse/fetch-sse-connection.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 90 | `src/adapters/realtime/websocket/index.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 90 | `src/adapters/realtime/sse/index.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 91 | `src/adapters/realtime/websocket/websocket-connection.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 91 | `src/adapters/realtime/sse/sse-parser.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 92 | `src/adapters/realtime/websocket/websocket-protocol.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) | | 92 | `src/adapters/realtime/stream-coordinator.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 93 | `src/adapters/service-worker/index.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 93 | `src/adapters/realtime/websocket/index.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 94 | `src/adapters/service-worker/service-worker-entry.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 94 | `src/adapters/realtime/websocket/websocket-connection.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 95 | `src/adapters/service-worker/service-worker-lifecycle.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 95 | `src/adapters/realtime/websocket/websocket-protocol.ts` | [Realtime/RPC](./02-realtime-and-browser-rpc.md) |
| 96 | `src/adapters/service-worker/service-worker-page-controller.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 96 | `src/adapters/service-worker/index.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 97 | `src/adapters/service-worker/service-worker-protocol.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 97 | `src/adapters/service-worker/service-worker-entry.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 98 | `src/adapters/service-worker/service-worker-removal.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 98 | `src/adapters/service-worker/service-worker-lifecycle.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 99 | `src/adapters/service-worker/service-worker-static-assets.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 99 | `src/adapters/service-worker/service-worker-page-controller.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 100 | `src/adapters/storage/browser-storage-adapter.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 100 | `src/adapters/service-worker/service-worker-protocol.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 101 | `src/adapters/storage/browser-storage-codec.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 101 | `src/adapters/service-worker/service-worker-removal.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 102 | `src/adapters/storage/index.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 102 | `src/adapters/service-worker/service-worker-static-assets.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 103 | `src/adapters/storage/indexeddb/index.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 103 | `src/adapters/storage/browser-storage-adapter.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 104 | `src/adapters/storage/indexeddb/indexeddb-failure.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 104 | `src/adapters/storage/browser-storage-codec.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 105 | `src/adapters/storage/indexeddb/indexeddb-governance.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 105 | `src/adapters/storage/index.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 106 | `src/adapters/storage/indexeddb/indexeddb-maintenance.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 106 | `src/adapters/storage/indexeddb/index.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 107 | `src/adapters/storage/indexeddb/indexeddb-migrations.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 107 | `src/adapters/storage/indexeddb/indexeddb-failure.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 108 | `src/adapters/storage/indexeddb/indexeddb-runtime.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 108 | `src/adapters/storage/indexeddb/indexeddb-governance.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 109 | `src/adapters/storage/indexeddb/indexeddb-types.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 109 | `src/adapters/storage/indexeddb/indexeddb-maintenance.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 110 | `src/adapters/storage/opfs/browser-opfs-runtime.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 110 | `src/adapters/storage/indexeddb/indexeddb-migrations.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 111 | `src/adapters/storage/opfs/index.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 111 | `src/adapters/storage/indexeddb/indexeddb-runtime.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 112 | `src/adapters/storage/opfs/indexeddb-opfs-journal.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 112 | `src/adapters/storage/indexeddb/indexeddb-types.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 113 | `src/adapters/storage/opfs/opfs-byte-store-adapter.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 113 | `src/adapters/storage/opfs/browser-opfs-runtime.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 114 | `src/adapters/storage/opfs/opfs-policy.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 114 | `src/adapters/storage/opfs/index.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 115 | `src/adapters/storage/opfs/opfs-worker-client.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 115 | `src/adapters/storage/opfs/indexeddb-opfs-journal.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 116 | `src/adapters/storage/opfs/opfs-worker-protocol.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 116 | `src/adapters/storage/opfs/opfs-byte-store-adapter.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 117 | `src/adapters/storage/opfs/opfs-worker-runtime.ts` | [Storage/files](./03-storage-and-browser-files.md) | | 117 | `src/adapters/storage/opfs/opfs-policy.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 118 | `src/adapters/telemetry/best-effort-telemetry.ts` | [Network/state](./01-network-and-state.md) | | 118 | `src/adapters/storage/opfs/opfs-worker-client.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 119 | `src/adapters/telemetry/index.ts` | [Network/state](./01-network-and-state.md) | | 119 | `src/adapters/storage/opfs/opfs-worker-protocol.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 120 | `src/adapters/web-push/inbound/notification-click-adapter.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 120 | `src/adapters/storage/opfs/opfs-worker-runtime.ts` | [Storage/files](./03-storage-and-browser-files.md) |
| 121 | `src/adapters/web-push/inbound/push-event-adapter.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 121 | `src/adapters/telemetry/best-effort-telemetry.ts` | [Network/state](./01-network-and-state.md) |
| 122 | `src/adapters/web-push/index.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 122 | `src/adapters/telemetry/index.ts` | [Network/state](./01-network-and-state.md) |
| 123 | `src/adapters/web-push/notification-registry.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 123 | `src/adapters/web-push/inbound/notification-click-adapter.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 124 | `src/adapters/web-push/push-association-fence-store.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 124 | `src/adapters/web-push/inbound/push-event-adapter.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 125 | `src/adapters/web-push/push-codec.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 125 | `src/adapters/web-push/index.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 126 | `src/adapters/web-push/push-registration-gateway.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 126 | `src/adapters/web-push/notification-registry.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 127 | `src/adapters/web-push/push-subscription-adapter.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 127 | `src/adapters/web-push/push-association-fence-store.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 128 | `src/adapters/web-push/runtime-support.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 128 | `src/adapters/web-push/push-codec.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 129 | `src/adapters/web-push/service-worker-runtime.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 129 | `src/adapters/web-push/push-registration-gateway.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 130 | `src/adapters/web-push/service-worker-scope-host.ts` | [Worker/push](./05-service-worker-and-web-push.md) | | 130 | `src/adapters/web-push/push-subscription-adapter.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 131 | `src/adapters/web-push/runtime-support.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 132 | `src/adapters/web-push/service-worker-runtime.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
| 133 | `src/adapters/web-push/service-worker-scope-host.ts` | [Worker/push](./05-service-worker-and-web-push.md) |
합계: **130/130**. 새 adapter 파일이 추가되면 이 ledger와 해당 상세 리뷰 inventory를 같은 변경에서 갱신한다. 합계: **133/133**. 새 adapter 파일이 추가되면 이 ledger와 해당 상세 리뷰 inventory를 같은 변경에서 갱신한다.
scripts/generate-supply-chain.ts
+2 -1
View File
@@ -21,6 +21,7 @@ import {
flattenPnpmDependencyTree, flattenPnpmDependencyTree,
isValidSha512Integrity, isValidSha512Integrity,
parsePnpmLockfilePackages, parsePnpmLockfilePackages,
PROJECT_NAME,
supplyChainDigest, supplyChainDigest,
verifySupplyChainCoherence, verifySupplyChainCoherence,
} from "./lib/supply-chain.ts"; } from "./lib/supply-chain.ts";
@@ -270,7 +271,7 @@ const provenance = {
], ],
}, },
runDetails: { runDetails: {
builder: { id: "local:clean-architecture-frontend-template" }, builder: { id: `local:${PROJECT_NAME}` },
metadata: { invocationId: "LOCAL_UNSIGNED" }, metadata: { invocationId: "LOCAL_UNSIGNED" },
}, },
materials: { materials: {
scripts/lib/local-release-evidence.ts
+2 -2
View File
@@ -65,6 +65,7 @@ import { secretScanRules } from "./secret-scan.ts";
import { import {
isValidSha512Integrity, isValidSha512Integrity,
parsePnpmLockfilePackages, parsePnpmLockfilePackages,
PROJECT_NAME,
supplyChainDigest, supplyChainDigest,
verifySupplyChainCoherence, verifySupplyChainCoherence,
} from "./supply-chain.ts"; } from "./supply-chain.ts";
@@ -303,8 +304,7 @@ export async function verifyLocalSupplyChainEvidence(
}); });
} }
export const LOCAL_EVIDENCE_VERIFIER_ID = export const LOCAL_EVIDENCE_VERIFIER_ID = `${PROJECT_NAME}/local-evidence-verifier`;
"clean-architecture-frontend-template/local-evidence-verifier";
export const LOCAL_EVIDENCE_VERIFIER_VERSION = "1"; export const LOCAL_EVIDENCE_VERIFIER_VERSION = "1";
export { export {
LOCAL_EVIDENCE_POLICY_INPUT_PATHS, LOCAL_EVIDENCE_POLICY_INPUT_PATHS,
scripts/lib/provider-evidence.ts
+2 -2
View File
@@ -4,13 +4,13 @@ import { z } from "zod";
import { import {
canonicalizeSupplyChainValue, canonicalizeSupplyChainValue,
PROJECT_NAME,
supplyChainDigest, supplyChainDigest,
} from "./supply-chain.ts"; } from "./supply-chain.ts";
export const PROVIDER_FUTURE_SKEW_MS = 5 * 60 * 1_000; export const PROVIDER_FUTURE_SKEW_MS = 5 * 60 * 1_000;
export const PROVIDER_MAX_LIFETIME_MS = 2 * 60 * 60 * 1_000; export const PROVIDER_MAX_LIFETIME_MS = 2 * 60 * 60 * 1_000;
export const PROMOTION_VERIFIER_ID = export const PROMOTION_VERIFIER_ID = `${PROJECT_NAME}/promotion-verifier`;
"clean-architecture-frontend-template/promotion-verifier";
export const PROMOTION_VERIFIER_VERSION = "3"; export const PROMOTION_VERIFIER_VERSION = "3";
const sha256 = z.string().regex(/^[a-f0-9]{64}$/u); const sha256 = z.string().regex(/^[a-f0-9]{64}$/u);
scripts/lib/supply-chain.ts
+21
View File
@@ -1,6 +1,27 @@
import { createHash } from "node:crypto"; import { createHash } from "node:crypto";
import { readFileSync } from "node:fs";
import { readFile } from "node:fs/promises"; import { readFile } from "node:fs/promises";
function readProjectName(): string {
const manifest: unknown = JSON.parse(
readFileSync(new URL("../../package.json", import.meta.url), "utf8"),
);
const name =
typeof manifest === "object" && manifest !== null
? (manifest as { name?: unknown }).name
: undefined;
if (typeof name !== "string" || name.length === 0) {
throw new TypeError("package.json must declare a non-empty \"name\"");
}
return name;
}
/**
* Identity every release artifact is attributed to. A project derived from this
* template renames itself by editing `name` in package.json and nothing else.
*/
export const PROJECT_NAME = readProjectName();
export type DependencyScope = "production" | "development"; export type DependencyScope = "production" | "development";
export type LockfilePackage = Readonly<{ export type LockfilePackage = Readonly<{
name: string; name: string;
tests/unit/security-followup-fixture.ts
+5 -3
View File
@@ -11,9 +11,11 @@ import path from "node:path";
import { localEvidenceAssessmentArtifactSchema } from "../../scripts/contracts/release-artifacts.ts"; import { localEvidenceAssessmentArtifactSchema } from "../../scripts/contracts/release-artifacts.ts";
import { PROMOTED_FILE_NAMES } from "../../scripts/contracts/promotion-artifacts.ts"; import { PROMOTED_FILE_NAMES } from "../../scripts/contracts/promotion-artifacts.ts";
import { import {
PROMOTION_VERIFIER_ID,
providerEvidenceSignaturePayload, providerEvidenceSignaturePayload,
trustPolicySha256, trustPolicySha256,
} from "../../scripts/lib/provider-evidence.ts"; } from "../../scripts/lib/provider-evidence.ts";
import { LOCAL_EVIDENCE_VERIFIER_ID } from "../../scripts/lib/local-release-evidence.ts";
import { import {
LOCAL_EVIDENCE_ASSESSMENT_PATH, LOCAL_EVIDENCE_ASSESSMENT_PATH,
distSha256, distSha256,
@@ -35,7 +37,7 @@ export function passingAssessment(): any {
generatedAt: "2026-08-02T00:00:00.000Z", generatedAt: "2026-08-02T00:00:00.000Z",
status: "PASS" as const, status: "PASS" as const,
verifier: { verifier: {
id: "clean-architecture-frontend-template/local-evidence-verifier", id: LOCAL_EVIDENCE_VERIFIER_ID,
version: "1", version: "1",
sourceSha256: digest("verifier source"), sourceSha256: digest("verifier source"),
}, },
@@ -180,7 +182,7 @@ export function syntheticSignedPromotionBundle() {
verifiedAt: "2026-08-02T01:00:00.000Z", verifiedAt: "2026-08-02T01:00:00.000Z",
status: "PASS", status: "PASS",
verifier: { verifier: {
id: "clean-architecture-frontend-template/promotion-verifier", id: PROMOTION_VERIFIER_ID,
version: "3", version: "3",
}, },
run, run,
@@ -496,7 +498,7 @@ export async function createArchivedAssessmentFixture(): Promise<{
const assessment = localEvidenceAssessmentArtifactSchema.parse({ const assessment = localEvidenceAssessmentArtifactSchema.parse({
...passingAssessment(), ...passingAssessment(),
verifier: { verifier: {
id: "clean-architecture-frontend-template/local-evidence-verifier", id: LOCAL_EVIDENCE_VERIFIER_ID,
version: "1", version: "1",
sourceSha256: supplyChainDigest( sourceSha256: supplyChainDigest(
policyInputs.filter(({ path: policyPath }) => verifierPaths.has(policyPath)), policyInputs.filter(({ path: policyPath }) => verifierPaths.has(policyPath)),