clean-architecture-frontend-template/docs/security/supply-chain.md

Build and supply-chain gate

Local blocking controls

• pnpm install --frozen-lockfile and a real manifest/lock mismatch fixture
• all direct and transitive lockfile rows with package SHA-512 integrity
• production/development, direct/transitive and platform-optional classification
• package-manifest license allow/deny policy
• approved inventory baseline digest and actual add/remove/change/upgrade diff
• independent review for new direct production dependencies
• CycloneDX 1.6 SBOM and inventory component/edge coherence
• source/lock/SBOM/dist-linked local provenance statement
• source, opt-in recipes, scripts, tests, tracked config/schema, public, built asset and generated release metadata secret scan
• two-build SOURCE_DATE_EPOCH reproducibility check

The canonical commands are:

corepack pnpm verify:lockfile
corepack pnpm verify:reproducible-build
corepack pnpm build:release
corepack pnpm verify:supply-chain
corepack pnpm check:supply-chain:fixtures

config/security/dependency-baseline.json is the approved local baseline. Changing it requires DEPENDENCY_BASELINE_OWNER and DEPENDENCY_BASELINE_REASON; editing the digest or hardcoding an empty diff is rejected.

External promotion controls

The vulnerability adapter reads the file named by VULNERABILITY_REPORT_PATH. It requires a provider, the exact lockfile digest, severity findings and valid independent, unexpired exception evidence. PROVENANCE_ATTESTATION_PATH must name a provider, signer and the exact built dist subject digest.

If either provider input is absent, local verification remains meaningful but artifacts/security/supply-chain-verification.json records promotionStatus: FAIL_UNVERIFIED. verify:supply-chain:promotion then exits non-zero. Scanner or signing outages are not converted to an empty PASS.

Approved vulnerability exceptions require vulnerability/package identity, owner, a different reviewer, reason and expiry. Expired or self-approved exceptions are blocking.