ci(053): release provenance — cosign, SBOM, SLSA, git-cliff CHANGELOG (WP-C1–C4)#502
Merged
Conversation
Deploying mcpproxy-docs with
|
| Latest commit: |
a4d3a71
|
| Status: | ⚡️ Build in progress... |
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 26272307132 --repo smart-mcp-proxy/mcpproxy-go
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of spec 053 — OSS Repo Improvements (Track C). One of ~3 PRs splitting the OSS-report backlog. All four WPs bolt onto the existing
release.yml— no GoReleaser migration (per spec non-goal).What's in here
release.ymlGenerate checksumsstep (the pipeline had none) →release-files/checksums.txt;sigstore/cosign-installer+cosign sign-blob --bundle→checksums.txt.cosign.bundleuploaded to the release. Thereleasejob now exposes ahashesoutput (base64 of checksums.txt) consumed by C3. Verify command documented inline.anchore/sbom-actionsteprelease-files/mcpproxy-<ver>.spdx.json, uploaded with the release (and covered by checksums + signed transitively).provenancejobslsa-framework/slsa-github-generatorgeneric generator,base64-subjects: needs.release.outputs.hashes,upload-assets: true. Pinned by semver tag@v2.1.0, NOT a SHA — the generator verifies its own ref to establish builder identity; SHA-pinning breaks it. This is the one documented exception to the repo's SHA-pin policy (commented in-line).cliff.toml+CHANGELOG.md+orhun/git-cliff-actionstepCHANGELOG.mdgenerated from full history (v0.1.0 → present, real grouped entries with PR/commit links). On release, git-cliff regeneratesrelease-files/CHANGELOG.md(uploaded as an asset). Deliberately does not commit back tomain— avoids PAT + branch-protection fragility (rationale in a comment).Step ordering in the
releasejobReorganize → Set version → SBOM → CHANGELOG → checksums (covers SBOM + CHANGELOG) → Create release (uploads
release-files/*) → install cosign → sign checksums → upload bundle. Theprovenancejob runs afterreleaseand consumes itshashesoutput.Verification
cosign-installerv3.10.1,sbom-actionv0.24.0,git-cliff-actionv4.8.0) re-resolved viagh api— match their comments. SLSA generator tagv2.1.0confirmed to exist.release.ymlparses;cliff.tomlis valid TOML;CHANGELOG.mdcontains real (non-fabricated) grouped entries.checksums.txt+ the cosign bundle from its own glob (a review-caught idempotency fix).This PR edits
release.yml; the sibling security PR (#501, WP-B5) rewritesrelease.ymlto SHA-pin all pre-existing actions. A merge conflict between the two is expected. Recommended order: merge #501 first, then rebase this branch — resolution is mechanical (keep #501's SHA pins on the pre-existing steps; keep this PR's new steps/jobs). The SLSA generator's semver-tag reference must stay un-SHA-pinned through the resolution.🤖 Generated with Claude Code