release: SBOM + cosign release pipeline + supply-chain hardening#46
Merged
Conversation
docker compose up --build used to fail right after git clone because env_file pointed at a gitignored .env that doesn't exist on first run. Switch to the long form with required: false so a missing .env is fine, and add a `cp .env.example .env` line to the Quick Start for users who want to populate ADMIN_API_KEY or GITHUB_TOKEN. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
) Codifies the workflow contributors (human or agent) must follow: - never commit directly on main or dev - any task starts on a feat|fix|chore|docs|hotfix/* branch cut from dev - flow is feat/* -> dev -> main Also documents the graphify knowledge graph so Claude reads graphify-out/GRAPH_REPORT.md before answering architecture questions. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Closes the documented-but-not-implemented gap on cosign signing and SBOM publishing. Bundles SHA-pinning of third-party actions in security.yml and fixes the gitleaks omission in README's detailed security section. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
12 tasks across two phases: Phase A on the feat branch (SHA-pinning, release.yml build-out, doc updates), Phase B post-merge (GHCR setup, end-to-end signature verification). Refs spec docs/superpowers/specs/2026-05-28-sbom-cosign-design.md
Pins every external action by commit SHA with a # vX.Y.Z comment. Closes the supply-chain gap where a compromised action maintainer could retag a version (e.g. aquasecurity/trivy-action@master is mutable HEAD) and inject malicious code into the signed image build. Refs spec docs/superpowers/specs/2026-05-28-sbom-cosign-design.md
CVE-2026-48710 (GHSA-86qp-5c8j-p5mr / PYSEC-2026-161 / X41-2026-002): "BadHost" — missing Host header validation in starlette poisons request.url.path and can bypass path-based security checks. Disclosed post-merge; pip-audit flagged it on the security gate for this PR. Transitive dependency of fastapi 0.136.1. Bumped via: uv lock --upgrade-package starlette uv export --no-dev --no-emit-project --format requirements-txt \ > requirements.lock Verified locally: pip-audit --requirement requirements.lock --strict -> No known vulnerabilities found pytest tests/ -> 366 passed
feat: SBOM + cosign release pipeline + supply-chain hardening
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promotes the SBOM + cosign release pipeline and supply-chain hardening from
devtomain. First merge firesrelease.ymlwhich publishes a signed image to GHCR.Includes:
security.yml— every third-party action SHA-pinned (26 refs).release.yml— new post-merge workflow (publish to GHCR + cosign keyless OIDC signature + CycloneDX SBOM attestation + SLSA L2 build provenance + smoke verify).docs/RELEASING.md— one-time GHCR setup, verification commands, rollback.README.md— Gitleaks documented (Secret scanning subsection), refined cosign claim, new "Verifying a published image" section.starlette1.0.0 → 1.1.0 (CVE-2026-48710 BadHost).Post-merge maintainer action required:
After the first
release.ymlrun, the GHCR package must be made Public and granted Write access to this repository. Full procedure indocs/RELEASING.md.Test plan
actionlintpasses on both workflowspip-audit --strictclean after starlette bumprelease.ymlfires and completes successfully on merge to main (smoke verify step proves the full chain)docs/RELEASING.md🤖 Generated with Claude Code