also looking at this
Gate releases on shipped artifact findings
#316
11 files
+454
-25
Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.
| @@ -528,9 +528,10 @@ jobs: | ||
| 528 | 528 | # Nothing here consumes the binary job's artifacts: this checks out, runs |
| 529 | 529 | # `bun install`, and publishes packages built from TypeScript. Signing a Zig |
| 530 | 530 | # binary and publishing an SDK are independent, and the workflow now says |
| 531 | # so. `!cancelled()` rather than `always()` so a cancelled run still stops. | |
| 532 | needs: [validate-release, pantry] | |
| 533 | if: ${{ !cancelled() && needs.validate-release.result == 'success' }} | |
| 531 | # so. The full-source scan's Critical gate still applies to both paths. | |
| 532 | # `!cancelled()` rather than `always()` so a cancelled run still stops. | |
| 533 | needs: [validate-release, release-sbom, pantry] | |
| 534 | if: ${{ !cancelled() && needs.validate-release.result == 'success' && needs.release-sbom.result == 'success' }} | |
| 534 | 535 | runs-on: ubuntu-latest |
| 535 | 536 | permissions: |
| 536 | 537 | contents: write |
| @@ -13,12 +13,17 @@ Each attempt removes previous JSON and text reports before validating its input. | ||
| 13 | 13 | A failed rerun therefore cannot attach a previous successful summary alongside |
| 14 | 14 | new diagnostics. Keep the input SBOM separate from the scanner's output files. |
| 15 | 15 | |
| 16 | The existing severity policy is unchanged: Critical findings fail the check; | |
| 17 | High findings emit an explicit warning and remain release-review items. A green | |
| 16 | Critical findings fail the full-repository scan and block both native and npm | |
| 17 | publishing. High findings in that broad inventory emit an explicit warning and | |
| 18 | remain release-review items. Before publication, a separate scan blocks High | |
| 19 | or Critical findings in the built native binaries and in the exact packed npm | |
| 20 | archives with their resolved production dependencies. A green full-repository | |
| 18 | 21 | scan is **not** release approval. Issue [#279](https://github.com/craft-native/craft/issues/279) |
| 19 | 22 | tracks the reviewed High/Critical policy and shipping-scope analysis; issue |
| 20 | 23 | [#276](https://github.com/craft-native/craft/issues/276) tracks locked dependency |
| 21 | advisories. No baseline or vulnerability exemption is added by this workflow. | |
| 24 | advisories. Native binary scanning records exact hashes and detected components, | |
| 25 | but static Zig code may not be identifiable from the binary alone; retain the | |
| 26 | full-source review. No baseline or vulnerability exemption is added by this workflow. | |
| 22 | 27 | |
| 23 | 28 | Syft and Grype Linux x64 downloads are pinned by release version and SHA-256 in |
| 24 | 29 | `.github/workflows/sbom.yml`. Tool updates must update both the asset URL and its |
| @@ -19,8 +19,10 @@ const steps = (job: Job) => job.steps?.map(step => step.run ?? '').join('\n') ?? | ||
| 19 | 19 | test('every publishing path depends on release identity validation', () => { |
| 20 | 20 | for (const name of ['pantry', 'npm', 'release-sbom', 'verify-release', 'verify-macos-downloads']) |
| 21 | 21 | expect(needs(release.jobs[name])).toContain('validate-release') |
| 22 | for (const name of ['npm', 'verify-release', 'verify-macos-downloads']) | |
| 22 | for (const name of ['verify-release', 'verify-macos-downloads']) | |
| 23 | 23 | expect(release.jobs[name].if).toBe("$") |
| 24 | expect(release.jobs.npm.if).toBe("$") | |
| 25 | expect(needs(release.jobs.npm)).toContain('release-sbom') | |
| 24 | 26 | }) |
| 25 | 27 | |
| 26 | 28 | test('registry indexing waits for the final manifest, macOS downloads and attached SBOMs', () => { |