[milestone Milestone 3 ] `wasmagent-ops/`: CI/CD pipeline updates to auto-generate trust artifacts on rel...

[telleroutlook]

🤖 Auto-filed from milestone doc bullet.

Repo: WasmAgent/.github
Milestone: Milestone 3 — Ops Tooling & Generator Infrastructure
Bullet:

wasmagent-ops/: CI/CD pipeline updates to auto-generate trust artifacts on release

Problem

The wasmagent-ops repository lacks CI/CD automation to generate trust artifacts during release workflows. Currently, trust artifacts (AgentBOM, MCP Posture, Trust Passport) must be generated manually. This creates a barrier to consistent, verifiable releases and delays artifact availability.

Approach

Create a GitHub Actions workflow that automatically generates all three trust artifact types when a release is published:

1. Create .github/workflows/release-artifacts.yml in the wasmagent-ops repository with:

   • Trigger: release: published event (types: [published])
   • Checkout the release tag ref
   • Build Go binaries with go build ./...
   • Generate AgentBOM using ./bin/generate-agentbom (from issue [milestone Milestone 3 ] wasmagent-ops/generators/: AgentBOM generator from execution traces (`generate... #75)
   • Generate Trust Passport using ./bin/passport export --format json --include-aep (from issue [milestone Milestone 1 ] agent-trust-infra/: Trust Passport export includes signed AEP events (`passpor... #66)
   • Generate MCP Posture report using ./bin/generate-mcp-posture
   • Sign each artifact with GPG (using gpg --detach-sign or equivalent)
   • Upload artifacts to the release as downloadable assets

2. Workflow steps:

   name: Release Trust Artifacts
   on:
     release:
       types: [published]
   jobs:
     generate-artifacts:
       runs-on: ubuntu-latest
       steps:
         - uses: actions/checkout@v4
           with:
             ref: ${{ github.event.release.tag_name }}
         - name: Set up Go
           uses: actions/setup-go@v5
           with:
             go-version: '1.22'
         - name: Build generators
           run: |
             go build -o bin/generate-agentbom ./cmd/generate-agentbom
             go build -o bin/passport ./cmd/passport
             go build -o bin/generate-mcp-posture ./cmd/generate-mcp-posture
         - name: Generate AgentBOM
           run: |
             ./bin/generate-agentbom --output agentbom.json
         - name: Generate Trust Passport
           run: |
             ./bin/passport export --format json --include-aep --output passport.json
         - name: Generate MCP Posture
           run: |
             ./bin/generate-mcp-posture --output mcp-posture.json
         - name: Sign artifacts
           run: |
             for artifact in agentbom.json passport.json mcp-posture.json; do
               gpg --detach-sign --armor $artifact
             done
         - name: Upload release assets
           uses: softprops/action-gh-release@v2
           with:
             files: |
               agentbom.json
               agentbom.json.asc
               passport.json
               passport.json.asc
               mcp-posture.json
               mcp-posture.json.asc

3. Optional enhancement: Add a workflow dispatch trigger for manual artifact generation on non-release commits.

Files

• Create: wasmagent-ops/.github/workflows/release-artifacts.yml (new file)
• Reference dependencies (already exist or are tracked in other issues):
  • wasmagent-ops/cmd/generate-agentbom/ — AgentBOM generator (issue [milestone Milestone 3 ] wasmagent-ops/generators/: AgentBOM generator from execution traces (`generate... #75)
  • wasmagent-ops/cmd/passport/ — Trust Passport CLI (issue [milestone Milestone 1 ] agent-trust-infra/: Trust Passport export includes signed AEP events (`passpor... #66)
  • wasmagent-ops/cmd/generate-mcp-posture/ — MCP Posture generator

Acceptance criteria

• File wasmagent-ops/.github/workflows/release-artifacts.yml exists and contains a workflow triggered on release: published
• Workflow builds all three generator binaries with go build ./...
• Workflow generates and uploads AgentBOM, Trust Passport, and MCP Posture artifacts to releases
• Artifacts are GPG-signed (.asc files)
• Command go build ./... passes in the wasmagent-ops repository
• Workflow passes act -l verification (list jobs without running)

Notes

• This workflow depends on the generators implemented in issues [milestone Milestone 3 ] wasmagent-ops/generators/: AgentBOM generator from execution traces (`generate... #75 (AgentBOM) and [milestone Milestone 1 ] agent-trust-infra/: Trust Passport export includes signed AEP events (`passpor... #66 (Trust Passport)
• GPG signing requires a GitHub Actions secret GPG_PRIVATE_KEY to be configured
• The MCP Posture generator command syntax should be validated against the actual implementation

---

Filed automatically.

[telleroutlook]

• Bot ID: claude-bot-go-GreenCloud-BigMem-worker-2
• Job ID: 846
• Released: 2026-07-07T00:18:27Z
• Reason: CI failed: Lint Markdown fail 7s https://github.com/WasmAgent/.github/actions/runs/28832343143/job/85508704384 Validate project index fail 3s https://github.com/WasmAgent/.github/actions/runs/28832343128/job/85508704336

[telleroutlook]

• Bot ID: claude-bot-go-GreenCloud-BigMem-worker-1
• Job ID: 846
• Released: 2026-07-07T00:32:09Z
• Reason: PR 89 conflicts with base and rebase failed: tests failed after rebase: verify manifest: (defaults — no .claude-bot/verify.yml) [PASS] build (go build ./...) took 13ms [FAIL] test (go test -short -timeout 120s ./...) took 8ms Failing

[telleroutlook]

• Bot ID: claude-bot-go-GreenCloud-BigMem-worker-2
• Job ID: 846
• Released: 2026-07-07T01:33:38Z
• Reason: retry_cap_reached

[telleroutlook]

🤖 Closing: this milestone bullet describes work in a separate repository (erp-agent, wasmagent-ops, or trace-pipeline) that is not managed by the bot. WasmAgent/.github has been moved to discuss_only mode — implementation issues should be filed in the target repository directly.