31 lines
975 B
JavaScript
31 lines
975 B
JavaScript
import { mkdir, readFile, writeFile } from "node:fs/promises";
|
|
|
|
const verification = JSON.parse(
|
|
await readFile(
|
|
"artifacts/security/supply-chain-verification.json",
|
|
"utf8",
|
|
),
|
|
);
|
|
const passed = verification.promotionStatus === "PASS";
|
|
const report = {
|
|
schemaVersion: 1,
|
|
status: passed ? "PASS" : "FAIL_UNVERIFIED",
|
|
vulnerabilityStatus: verification.vulnerabilityStatus,
|
|
provenanceAttestationStatus:
|
|
verification.provenanceAttestationStatus,
|
|
lockfileSha256: verification.lockfileSha256,
|
|
distSha256: verification.distSha256,
|
|
};
|
|
await mkdir("artifacts/security", { recursive: true });
|
|
await writeFile(
|
|
"artifacts/security/promotion-verification.json",
|
|
`${JSON.stringify(report, null, 2)}\n`,
|
|
);
|
|
if (!passed) {
|
|
process.stderr.write(
|
|
"Supply-chain promotion is FAIL_UNVERIFIED: external vulnerability and signed provenance evidence are required.\n",
|
|
);
|
|
process.exit(1);
|
|
}
|
|
process.stdout.write("Supply-chain promotion evidence: PASS\n");
|