also looking at this
Gate releases on shipped artifact findings
#316
11 files
+454
-25
| @@ -26,7 +26,9 @@ jobs: | ||
| 26 | 26 | needs: validate-release |
| 27 | 27 | uses: ./.github/workflows/sbom.yml |
| 28 | 28 | with: |
| 29 | enforce_high: true | |
| 29 | # Keep the full-source report for review. The High gate runs against | |
| 30 | # the artifacts and production dependencies prepared for publication. | |
| 31 | enforce_high: false | |
| 30 | 32 | |
| 31 | 33 | pantry: |
| 32 | 34 | # The reusable SBOM workflow includes the vulnerability scan. Publishing |
| @@ -305,7 +307,13 @@ jobs: | ||
| 305 | 307 | --timeout 30m |
| 306 | 308 | codesign --verify --deep --strict "$binary" |
| 307 | 309 | rm "$archive" |
| 308 | done | |
| 310 | ||
| 311 | - uses: ./.github/actions/setup-release-scanners | |
| 312 | ||
| 313 | - name: Scan binaries prepared for publication | |
| 314 | env: | |
| 315 | CRAFT_PLATFORM: ${{ runner.os == 'macOS' && 'macos' || 'linux' }} | |
| 316 | run: bun scripts/scan-release-artifacts.ts "$CRAFT_PLATFORM" packages/zig/zig-out "$RUNNER_TEMP/native-release-scan" | |
| 309 | 317 | |
| 310 | 318 | # ── Publish & Release ────────────────────────────── |
| 311 | 319 | # Pantry action handles everything: |
| @@ -520,9 +528,10 @@ jobs: | ||
| 520 | 528 | # Nothing here consumes the binary job's artifacts: this checks out, runs |
| 521 | 529 | # `bun install`, and publishes packages built from TypeScript. Signing a Zig |
| 522 | 530 | # binary and publishing an SDK are independent, and the workflow now says |
| 523 | # so. `!cancelled()` rather than `always()` so a cancelled run still stops. | |
| 524 | needs: [validate-release, pantry] | |
| 525 | if: ${{ !cancelled() && needs.validate-release.result == 'success' }} | |
| 531 | # so. The full-source scan's Critical gate still applies to both paths. | |
| 532 | # `!cancelled()` rather than `always()` so a cancelled run still stops. | |
| 533 | needs: [validate-release, release-sbom, pantry] | |
| 534 | if: ${{ !cancelled() && needs.validate-release.result == 'success' && needs.release-sbom.result == 'success' }} | |
| 526 | 535 | runs-on: ubuntu-latest |
| 527 | 536 | permissions: |
| 528 | 537 | contents: write |
| @@ -535,16 +544,29 @@ jobs: | ||
| 535 | 544 | |
| 536 | 545 | - name: Setup Pantry (provides Bun, Zig, etc.) |
| 537 | 546 | uses: pantry-pm/pantry/packages/action@235036fa0f48bae99b2293df5a3dc35c809b1777 # pinned: last SHA whose bundled typescript resolves on linux-x64 |
| 547 | - uses: actions/setup-node@v6 | |
| 548 | with: | |
| 549 | node-version: '24' | |
| 550 | registry-url: https://registry.npmjs.org | |
| 551 | package-manager-cache: false | |
| 538 | 552 | - name: Install Dependencies |
| 539 | 553 | run: bun install --frozen-lockfile |
| 540 | 554 | |
| 555 | - name: Install npm CLI with trusted publishing support | |
| 556 | run: npm install --global npm@11.15.0 | |
| 557 | ||
| 558 | - uses: ./.github/actions/setup-release-scanners | |
| 559 | ||
| 541 | 560 | - name: Test package regressions |
| 542 | 561 | run: bun run test:packages |
| 543 | 562 | |
| 544 | 563 | - name: Build and verify every npm artifact |
| 545 | run: bun run verify:npm | |
| 564 | run: bun scripts/npm-packages.ts --archive-dir "$RUNNER_TEMP/craft-npm-archives" | |
| 565 | ||
| 566 | - name: Scan packed npm artifacts and production dependencies | |
| 567 | run: bun scripts/scan-release-artifacts.ts npm "$RUNNER_TEMP/craft-npm-archives" "$RUNNER_TEMP/npm-release-scan" | |
| 546 | 568 | |
| 547 | - name: Publish to npm | |
| 548 | run: pantry publish --npm --access public | |
| 569 | - name: Publish scanned npm archives | |
| 570 | run: bun scripts/publish-npm-archives.ts "$RUNNER_TEMP/craft-npm-archives" | |
| 549 | 571 | env: |
| 550 | NPM_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| 572 | NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |