fix(release): scope attested SBOM to the shipped runtime closure - #307
Merged
Conversation
Generate the attested SBOM from a prod-only staging tree (exact resolved versions, runtime dependency closure only) instead of scanning the whole repo, so a consumer verifying the .vsix attestation no longer sees devDependencies (vitest/biome/@types/*) that never ship. The SBOM step stays before Package .vsix, preserving the audit-vsix last-gate invariant. A new scripts/verify-sbom-scope.mjs gate fails the release if the SBOM leaks dev tooling, drops a declared/known-transitive runtime dep, or carries non-exact versions.
- verify-sbom-scope: null-guard sbom (sbom?.packages) so a JSON.parse("null")
SBOM fails closed via the CLI exit-1 + ::error:: path instead of throwing
an uncaught TypeError that bypasses it.
- verify-sbom-scope test: add a non-npm (pypi) purl fixture with a range
version so the pkg:npm/ discriminator is non-vacuous, plus a null-sbom
degenerate-scan case.
- publish.yml: correct the 'ONLY third-party action' comment — pnpm/action-setup
is also third-party; the accurate claim is 'only third-party action on the
build to package to attest critical path'.
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The publish workflow generated its SPDX SBOM from
path: .(the whole build-input graph — devDependencies, lockfile, fullnode_modules) and cryptographically bound it to the shipped.vsixdigest. A consumer runninggh attestation verifytherefore saw vitest/biome/@types/* as if they ship, producing false-positive vulnerability matches. This re-scopes the attested SBOM to the shipped runtime dependency closure only.Changes
publish.yml: before packaging, assemble a prod-only dependency tree in a throwaway$RUNNER_TEMP/sbom-srcstaging dir (pnpm install --prod --frozen-lockfile, lockfile then removed) and pointanchore/sbom-actionat it. Result: exact resolved versions, the full runtime closure (incl. transitive@marijn/find-cluster-break/crelt/style-mod/w3c-keyname), and zero devDependencies.package.json+pnpm-lock.yaml+pnpm-workspace.yaml+.npmrcare copied so--frozen-lockfileresolves identically to the real install.Package .vsix, soaudit-vsix.mjsremains the last gate before attest + publish (the third-party action never sees the.vsix) — the existing security invariant is preserved, not reordered.scripts/verify-sbom-scope.mjsgate (run after SBOM generation, fail-closed): rejects the release if the SBOM leaks build-only tooling, drops a declared or known-transitive runtime dep, or carries non-exact versions.test/build/verify-sbom-scope.test.ts: 19 unit tests pinning the gate's four branches (non-vacuous).Scope note: this lists the prod dependency closure — a conservative superset of the esbuild-bundled set (it also lists prod-transitive deps that get tree-shaken out). A byte-exact bundled SBOM would need a hand-rolled SPDX generator off the esbuild metafile; deferred as a documented future refinement.
Related
Test Plan
pnpm exec vitest run test/build/verify-sbom-scope.test.ts— 19 passpnpm compileclean; workflow YAML valid; step orderAssemble → Generate SBOM → Verify SBOM → Package → Audit .vsix → Attest