feat(ci): attach SBOM/provenance/safety evidence to GitHub Releases - #59
Merged
Conversation
release.yml generated SBOM, build-provenance, and other safety-case evidence on every tag push, but only ever committed those files back into git history on main. They were never uploaded as release assets, so "the SBOM for v1.3.0" had no stable, versioned, downloadable location — main's copy is regenerated and overwritten on every subsequent tag and does not correspond to any one past release. Confirmed empty asset lists on existing releases via `gh api repos/SoundMatt/go-LIN/releases/tags/v1.3.0 --jq '.assets'`. Add a step that attaches sbom.json, provenance.json, artifact-manifest.json, fmea.json, tara.json, and safety-case.json to the GitHub Release for the tag this job is running for — the standard SLSA/SBOM distribution pattern `gh release download` and SBOM scanners expect. The release for a given tag may already exist by the time this job runs (created by whatever process pushed the tag) or may not yet, so the step handles both: creates a minimal release if one doesn't already exist, then always uploads/clobbers the evidence assets. Closes #52 Signed-off-by: Matt <47545907+SoundMatt@users.noreply.github.com>
…ssets Signed-off-by: Matt <47545907+SoundMatt@users.noreply.github.com>
#56 bumped the gofusa pin to v0.47.0 and turned on the fmea -strict content-quality gate in ci.yml's "gofusa" and "compliance" jobs, but release.yml's own "Install go-FuSa" / "Regenerate dFMEA table" steps were left on v0.36.0 without -strict — the tag-push release job that regenerates and commits safety evidence straight to main was silently out of step with the rest of the repo's pin. Bump release.yml to v0.47.0 and add -strict to its fmea step to match ci.yml's gofusa/compliance jobs, so all three workflow locations use an identical, explicit pinned version. Verified locally with go-FuSa v0.47.0: full gofusa lifecycle (check/ trace/cyber/vuln/qualify/verify/coverage/hara/boundary/sci/coupling/ tara/fmea -strict/release/safety-case/audit-pack) and all 7 standards gap reports (iso26262/iec61508/iso21434/iec62443/do178/unece/slsa) pass cleanly with 0 real gaps; go build/vet/test -race all green. Signed-off-by: Matt <47545907+SoundMatt@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
release.ymlgenerates SBOM (gofusa release), build-provenance, and other safety-case evidence on every tag push, but only ever commits those files back into git history onmain. They were never uploaded as release assets — confirmedgh api repos/SoundMatt/go-LIN/releases/tags/v1.3.0 --jq '.assets'returns[].This means "the SBOM for v1.3.0" has no stable, versioned, downloadable location:
main's current copy is regenerated and overwritten on every subsequent tag and doesn't correspond to any one past release, and standard SBOM/provenance tooling that looks at Release assets (gh release download, Dependabot, SBOM scanners) finds nothing.Adds a step that attaches
sbom.json,provenance.json,artifact-manifest.json,fmea.json,tara.json, andsafety-case.jsonto the GitHub Release for the tag being built. The release may already exist by the time this job runs (created by whatever process pushed the tag) or may not — the step creates a minimal one if needed, then always uploads/clobbers the evidence assets, so it's idempotent either way.Closes #52
Test plan
gh release view/gh release uploadflag usage verified againstgh's own help outputgh release view v1.3.0→ 0,gh release view v999.999.999→ 1) so the create-if-missing branch is correctgo build/go vet/go test ./...unaffected (workflow-only change)