release: attest exact sealed SBOM evidence - #797
Conversation
|
@opencode-agent Implement the bounded GREEN slice for exact current RED head The permanent exact-head RED workflow is valid:
Implement the organization-owned exact-artifact SBOM attestation boundary without changing reviewer identities, model credentials, existing review workflows, protected refs, release jobs, or package publication. Allowed permanent paths
Do not add temporary, one-shot, self-modifying, branch-writing, repair, generated-patch, encoded-payload, or model-executing workflows. Reusable workflow contractCreate Keep the workflow-level token read-only. Scope the credentialed attestation job to the reviewed minimum: permissions:
contents: read
id-token: write
attestations: write
artifact-metadata: writeDo not grant package, release, pull-request, issue, ref, workflow, security-event, or repository-content write authority. Do not use Checkout the trusted verifier only from the immutable called-workflow identity: repository: ${{ job.workflow_repository }}
ref: ${{ job.workflow_sha }}
persist-credentials: falseUse a separate trusted-control-plane path. Never checkout the caller repository, caller source SHA, a mutable central branch/tag, or downloaded evidence as executable source. Download only the explicitly named same-run sealed evidence artifact into a separate untrusted-data path with an immutable official action pin. Verify the caller-supplied artifact digest against trusted GitHub artifact metadata or a cryptographically equivalent fail-closed receipt; GitHub's warning-only digest behavior must not be treated as success. If the platform does not expose a trustworthy exact digest without broadening privileges, fail closed and document the required caller receipt rather than silently weakening the contract. Trusted verifierImplement Before any attestation, require:
The verifier must expose a narrow documented CLI and be independently testable without OIDC or GitHub APIs. Signing and verificationUse immutable Capture each action's
Use GitHub CLI attestation verification only as a verifier; it must not publish, create releases, move refs, or mutate repository contents. Offline evidenceCreate a deterministic offline-verification directory containing at least:
Upload this evidence with an immutable official action pin and finite retention. Keep wheel and sdist as the only package-manager publication inputs; SBOMs and bundles are evidence, not packages. Quality gatesExtend
Do not weaken existing central full-test coverage or security gates to make this slice pass. DocumentationWrite
Update |
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
@opencode-agent The exact current RED head advanced to The refinement closes the artifact-archive identity gap without granting extra authority to the OIDC signer:
No production, workflow, permission, or documentation implementation was added in this commit. Preserve the earlier immutable RED run and reproduce a new exact-current-head RED result before GREEN implementation. All other requirements in comment |
1 participant
Test-first scope
This draft starts the organization-owned reusable SBOM attestation boundary required by #783 and
ContextualWisdomLab/EgressWeave#46.f070c504c1cb06891b800d7ab0cf6ac7d3cf8eae.363e4e08ffcf5a27403da007ee2dfdcbda05c534.a26f09a9f6c403db1f4db334ec71299a97a4cd7c.The current head intentionally contains only:
The RED contract requires the future implementation to:
workflow_call, with explicit required repository, exact source SHA, sealed-artifact reference/digest, wheel/sdist/SBOM filenames and digests, source-identity/checksum digests, CycloneDX schema, and predicate type;${{ job.workflow_repository }}and${{ job.workflow_sha }}rather than caller source or a mutable branch;contents: read,id-token: write,attestations: write, andartifact-metadata: writeto the signing boundary;actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26exactly once for each canonical distribution;No signing workflow or verifier exists on this RED head, so the exact contract must fail for the intended missing implementation rather than pass vacuously. No model, caller, or downloaded file receives OIDC, attestation, artifact-metadata, package, release, ref, pull-request, or repository-write authority.
Do not merge until a later exact GREEN head passes the dedicated quality workflow, complete central tests, 100% production statement/branch coverage and public docstrings for the verifier, Python Security, Security Scan, CodeQL, Semgrep, Secret Scan, OSV, Scorecard, SBOM, completed CodeRabbit/OpenCode/Noema review, qualifying independent non-author approval, zero unresolved valid findings, and every repository protection.
Progresses #783.