feat: SBOM + cosign release pipeline + supply-chain hardening#45
Merged
Conversation
Closes the documented-but-not-implemented gap on cosign signing and SBOM publishing. Bundles SHA-pinning of third-party actions in security.yml and fixes the gitleaks omission in README's detailed security section. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
12 tasks across two phases: Phase A on the feat branch (SHA-pinning, release.yml build-out, doc updates), Phase B post-merge (GHCR setup, end-to-end signature verification). Refs spec docs/superpowers/specs/2026-05-28-sbom-cosign-design.md
Pins every external action by commit SHA with a # vX.Y.Z comment. Closes the supply-chain gap where a compromised action maintainer could retag a version (e.g. aquasecurity/trivy-action@master is mutable HEAD) and inject malicious code into the signed image build. Refs spec docs/superpowers/specs/2026-05-28-sbom-cosign-design.md
CVE-2026-48710 (GHSA-86qp-5c8j-p5mr / PYSEC-2026-161 / X41-2026-002): "BadHost" — missing Host header validation in starlette poisons request.url.path and can bypass path-based security checks. Disclosed post-merge; pip-audit flagged it on the security gate for this PR. Transitive dependency of fastapi 0.136.1. Bumped via: uv lock --upgrade-package starlette uv export --no-dev --no-emit-project --format requirements-txt \ > requirements.lock Verified locally: pip-audit --requirement requirements.lock --strict -> No known vulnerabilities found pytest tests/ -> 366 passed
7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a post-merge release pipeline that publishes the container image to GHCR, signs it with cosign keyless OIDC, attaches a CycloneDX SBOM attestation, and produces a SLSA L2 build provenance attestation. Also hardens
security.ymlby SHA-pinning every third-party action.Spec: docs/superpowers/specs/2026-05-28-sbom-cosign-design.md
Plan: docs/superpowers/plans/2026-05-28-sbom-cosign-release-pipeline-plan.md
What's in this PR
security.yml— SHA-pinned every third-party action (26 references). Closes the supply-chain gap whereaquasecurity/trivy-action@masterwas a mutable HEAD.release.yml— new workflow that fires onpush: mainandworkflow_dispatch. Strict permissions ({}default, escalated per-job for OIDC + GHCR). Single job owns the entire chain so one OIDC token frame covers every signing op.cosign attest --type cyclonedx).actions/attest-build-provenance.cosign verify+cosign verify-attestationon the published artefacts before the workflow exits.docs/RELEASING.md— one-time GHCR setup, verification commands, rollback procedure.README.md— adds Gitleaks (Secret scanning subsection), refines cosign claim, adds a "Verifying a published image" section.Test plan
actionlint .github/workflows/security.ymlexits 0actionlint .github/workflows/release.ymlexits 0@v*or@masterreferences remain for third-party actions insecurity.ymldev, open dev → main PR; release.yml fires on merge to maindocs/RELEASING.md(one-time GHCR visibility + Actions access)Notes
release.ymldoes NOT run on this PR (onlypush: main/workflow_dispatch).docs/RELEASING.md.🤖 Generated with Claude Code