open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-21 01:32:44 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
dce72c800f9f575f3f00e405eea3ac8ec411fe11
qinglong/scripts/ql3-cluster-image-release-audit.cjs
T

1163 lines
48 KiB
JavaScript
Raw Blame History

#!/usr/bin/env node
'use strict';
const fs = require('node:fs');
const path = require('node:path');
const yaml = require('js-yaml');
const DEFAULT_ROOT = path.resolve(__dirname, '..');
const CI_WORKFLOW_PATH = '.github/workflows/ql3-ci.yml';
const RELEASE_WORKFLOW_PATH = '.github/workflows/ql3-image-release.yml';
const MAX_WORKFLOW_BYTES = 256 * 1024;
function readBoundedText(filePath) {
const stat = fs.statSync(filePath);
if (!stat.isFile() || stat.size < 2 || stat.size > MAX_WORKFLOW_BYTES) {
throw new Error(`invalid bounded workflow file: ${filePath}`);
}
return fs.readFileSync(filePath, 'utf8');
}
function requirePattern(source, pattern, finding) {
if (!pattern.test(source)) {
throw new Error(finding);
}
}
function requireOccurrences(source, pattern, minimum, finding) {
const matches = source.match(pattern) || [];
if (matches.length < minimum) {
throw new Error(finding);
}
}
function requireExactOccurrences(source, pattern, expected, finding) {
const matches = source.match(pattern) || [];
if (matches.length !== expected) {
throw new Error(finding);
}
}
function auditClusterImageCiWorkflow(
source,
adminProductLiveContract = readBoundedText(
path.join(
DEFAULT_ROOT,
'scripts/ql3-cluster-admin-product-live-contract.cjs',
),
),
) {
const workflow = yaml.load(source);
const clusterImageJob = workflow?.jobs?.['cluster-image'];
const localImageJob = workflow?.jobs?.['local-image'];
const expectedNativeMatrix = [
{
runner: 'ubuntu-24.04',
node_arch: 'x64',
image_arch: 'amd64',
image: 'control',
repository: 'qinglong3-cluster-control',
runtime_user: '10001:10001',
dockerfile: 'deploy/containers/ql3-cluster-control/Dockerfile',
target: 'runtime',
},
{
runner: 'ubuntu-24.04-arm',
node_arch: 'arm64',
image_arch: 'arm64',
image: 'control',
repository: 'qinglong3-cluster-control',
runtime_user: '10001:10001',
dockerfile: 'deploy/containers/ql3-cluster-control/Dockerfile',
target: 'runtime',
},
{
runner: 'ubuntu-24.04',
node_arch: 'x64',
image_arch: 'amd64',
image: 'control-ai',
repository: 'qinglong3-cluster-control-ai',
runtime_user: '10001:10001',
dockerfile: 'deploy/containers/ql3-cluster-control/Dockerfile',
target: 'runtime-ai',
},
{
runner: 'ubuntu-24.04-arm',
node_arch: 'arm64',
image_arch: 'arm64',
image: 'control-ai',
repository: 'qinglong3-cluster-control-ai',
runtime_user: '10001:10001',
dockerfile: 'deploy/containers/ql3-cluster-control/Dockerfile',
target: 'runtime-ai',
},
{
runner: 'ubuntu-24.04',
node_arch: 'x64',
image_arch: 'amd64',
image: 'admin',
repository: 'qinglong3-cluster-admin',
runtime_user: '10001:10001',
dockerfile: 'deploy/containers/ql3-cluster-admin/Dockerfile',
target: 'runtime',
},
{
runner: 'ubuntu-24.04-arm',
node_arch: 'arm64',
image_arch: 'arm64',
image: 'admin',
repository: 'qinglong3-cluster-admin',
runtime_user: '10001:10001',
dockerfile: 'deploy/containers/ql3-cluster-admin/Dockerfile',
target: 'runtime',
},
{
runner: 'ubuntu-24.04',
node_arch: 'x64',
image_arch: 'amd64',
image: 'worker',
repository: 'qinglong3-worker',
runtime_user: '65532:65532',
dockerfile: 'deploy/containers/ql3-worker/Dockerfile',
target: 'runtime',
},
{
runner: 'ubuntu-24.04-arm',
node_arch: 'arm64',
image_arch: 'arm64',
image: 'worker',
repository: 'qinglong3-worker',
runtime_user: '65532:65532',
dockerfile: 'deploy/containers/ql3-worker/Dockerfile',
target: 'runtime',
},
];
const expectedLocalNativeMatrix = [
{
runner: 'ubuntu-24.04',
node_arch: 'x64',
image_arch: 'amd64',
},
{
runner: 'ubuntu-24.04-arm',
node_arch: 'arm64',
image_arch: 'arm64',
},
];
const expectedOciMatrix = [
{
image: 'control',
dockerfile: 'deploy/containers/ql3-cluster-control/Dockerfile',
target: 'runtime',
},
{
image: 'control-ai',
dockerfile: 'deploy/containers/ql3-cluster-control/Dockerfile',
target: 'runtime-ai',
},
{
image: 'admin',
dockerfile: 'deploy/containers/ql3-cluster-admin/Dockerfile',
target: 'runtime',
},
{
image: 'local',
dockerfile: 'deploy/containers/ql3-local-application/Dockerfile',
target: 'runtime',
},
{
image: 'worker',
dockerfile: 'deploy/containers/ql3-worker/Dockerfile',
target: 'runtime',
},
];
if (
JSON.stringify(
workflow?.jobs?.['cluster-image']?.strategy?.matrix?.include,
) !== JSON.stringify(expectedNativeMatrix) ||
JSON.stringify(
workflow?.jobs?.['local-image']?.strategy?.matrix?.include,
) !== JSON.stringify(expectedLocalNativeMatrix) ||
JSON.stringify(workflow?.jobs?.['image-oci']?.strategy?.matrix?.include) !==
JSON.stringify(expectedOciMatrix)
) {
throw new Error(
'image CI matrices must contain only exact control/control-ai/admin/local/worker amd64/arm64 evidence targets',
);
}
const expectedTrivyInputs = {
version: 'v0.70.0',
scanners: 'vuln',
'vuln-type': 'os',
severity: 'HIGH,CRITICAL',
'ignore-unfixed': 'false',
'exit-code': '1',
format: 'table',
'hide-progress': 'true',
timeout: '10m0s',
cache: 'false',
};
for (const [job, imageRef, ignores, label] of [
[
localImageJob,
'qinglong3-local-application:ci-${{ matrix.image_arch }}',
'${{ runner.temp }}/ql3-local-${{ matrix.image_arch }}.trivyignore.yaml',
'local',
],
[
clusterImageJob,
'${{ matrix.repository }}:ci-${{ matrix.image_arch }}',
'${{ runner.temp }}/ql3-${{ matrix.image }}-${{ matrix.image_arch }}.trivyignore.yaml',
'cluster',
],
]) {
const step = job?.steps?.find(
(entry) =>
entry.uses ===
'aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25',
);
if (
!step ||
step['continue-on-error'] !== undefined ||
JSON.stringify(step.with) !==
JSON.stringify({
version: expectedTrivyInputs.version,
'image-ref': imageRef,
scanners: expectedTrivyInputs.scanners,
'vuln-type': expectedTrivyInputs['vuln-type'],
severity: expectedTrivyInputs.severity,
'ignore-unfixed': expectedTrivyInputs['ignore-unfixed'],
'exit-code': expectedTrivyInputs['exit-code'],
format: expectedTrivyInputs.format,
'hide-progress': expectedTrivyInputs['hide-progress'],
timeout: expectedTrivyInputs.timeout,
cache: expectedTrivyInputs.cache,
trivyignores: ignores,
})
) {
throw new Error(
`${label} native image CI must use the exact pinned OS-only Trivy failure gate`,
);
}
}
requireOccurrences(
source,
/node scripts\/ql3-image-os-vulnerability-policy\.cjs/g,
2,
'native image CI must materialize reviewed image-scoped Trivy exceptions',
);
requirePattern(
source,
/--image=local\s+--output=\$\{\{ runner\.temp \}\}\/ql3-local-\$\{\{ matrix\.image_arch \}\}\.trivyignore\.yaml/,
'local native image CI must materialize the local exception view',
);
requirePattern(
source,
/--image=\$\{\{ matrix\.image \}\}\s+--output=\$\{\{ runner\.temp \}\}\/ql3-\$\{\{ matrix\.image \}\}-\$\{\{ matrix\.image_arch \}\}\.trivyignore\.yaml/,
'cluster native image CI must materialize the selected exception view',
);
requirePattern(
source,
/^ cluster-image:\s*$/m,
'QL3 CI must contain a dedicated cluster-image job',
);
requirePattern(
source,
/runner: ubuntu-24\.04\s+node_arch: x64\s+image_arch: amd64/,
'cluster image CI must use a native x64 runner',
);
requirePattern(
source,
/runner: ubuntu-24\.04-arm\s+node_arch: arm64\s+image_arch: arm64/,
'cluster image CI must use a native arm64 runner',
);
requirePattern(
source,
/node --test[\s\S]*test\/back\/ql3ClusterImageSbom\.test\.cjs[\s\S]*test\/back\/ql3ClusterImageReleaseAudit\.test\.cjs[\s\S]*test\/back\/ql3ReleaseCandidateContract\.test\.cjs[\s\S]*test\/back\/ql3ReleaseSetContract\.test\.cjs[\s\S]*test\/back\/ql3ReleaseCatalogContract\.test\.cjs[\s\S]*test\/back\/ql3ReleaseCatalogConsumptionCeremony\.test\.cjs[\s\S]*test\/back\/ql3DeploymentLockContract\.test\.cjs/,
'cluster image CI must run SBOM, candidate, release-set, durable catalog, deployment-lock and workflow negative tests; catalog consumption ceremony is mandatory',
);
requirePattern(
source,
/pnpm audit:image-release:ql3/,
'image CI must audit the shared release workflow contract',
);
requirePattern(
source,
/pnpm audit:deployment-lock-surfaces:ql3/,
'supply-chain CI must freeze the reviewed deployment image surfaces',
);
requirePattern(
source,
/test\/back\/ql3VersionTransition\.test\.cjs/,
'supply-chain CI must run release version transition negative tests',
);
requirePattern(
source,
/pnpm audit:release-version:ql3/,
'supply-chain CI must audit the source-derived release version identity',
);
requirePattern(
source,
/docker build[\s\S]*--file \$\{\{ matrix\.dockerfile \}\}[\s\S]*--target \$\{\{ matrix\.target \}\}/,
'cluster image CI must build each exact selected Dockerfile target',
);
for (const [image, runner, nodeArchitecture, imageArchitecture] of [
['control', 'ubuntu-24\\.04', 'x64', 'amd64'],
['control', 'ubuntu-24\\.04-arm', 'arm64', 'arm64'],
['control-ai', 'ubuntu-24\\.04', 'x64', 'amd64'],
['control-ai', 'ubuntu-24\\.04-arm', 'arm64', 'arm64'],
['admin', 'ubuntu-24\\.04', 'x64', 'amd64'],
['admin', 'ubuntu-24\\.04-arm', 'arm64', 'arm64'],
['worker', 'ubuntu-24\\.04', 'x64', 'amd64'],
['worker', 'ubuntu-24\\.04-arm', 'arm64', 'arm64'],
]) {
requirePattern(
source,
new RegExp(
`runner: ${runner}\\s+node_arch: ${nodeArchitecture}\\s+image_arch: ${imageArchitecture}\\s+image: ${image}`,
),
`cluster image CI is missing native ${image} ${imageArchitecture}`,
);
}
requireOccurrences(
source,
/--image=\$\{\{ matrix\.image \}\}/g,
2,
'cluster image CI must select the exact SBOM profile for build and inventory',
);
requirePattern(
source,
/--read-only[\s\S]*--user \$\{\{ matrix\.runtime_user \}\}[\s\S]*--inventory-root=\/opt\/qinglong\/node_modules/,
'cluster image CI must reconcile the SBOM with a read-only non-root image inventory',
);
requirePattern(
source,
/unexpected image contract/,
'cluster image CI must verify architecture and runtime user',
);
requirePattern(
source,
/name: Run the bounded Cluster Admin product facade\s+if: matrix\.image == 'admin'\s+env:\s+IMAGE: qinglong3-cluster-admin:ci-\$\{\{ matrix\.image_arch \}\}\s+QL3_CLUSTER_ADMIN_PRODUCT_LIVE: '1'\s+run: node scripts\/ql3-cluster-admin-product-live-contract\.cjs --image="\$\{IMAGE\}"/,
'native admin image CI must run the bounded product facade contract',
);
requirePattern(
adminProductLiveContract,
/runOperatorContextContract\(image\);[\s\S]*operatorContext: true,[\s\S]*contextPreflight: true,[\s\S]*contextReadiness: true/,
'native admin image contract must verify owner-private operator context injection, offline preflight and read-only readiness',
);
requirePattern(
source,
/^ image-oci:\s*$/m,
'QL3 CI must contain a multi-architecture OCI evidence job',
);
requirePattern(
source,
/- image: control\s+dockerfile: deploy\/containers\/ql3-cluster-control\/Dockerfile\s+target: runtime\s+- image: control-ai\s+dockerfile: deploy\/containers\/ql3-cluster-control\/Dockerfile\s+target: runtime-ai\s+- image: admin\s+dockerfile: deploy\/containers\/ql3-cluster-admin\/Dockerfile\s+target: runtime\s+- image: local\s+dockerfile: deploy\/containers\/ql3-local-application\/Dockerfile\s+target: runtime\s+- image: worker\s+dockerfile: deploy\/containers\/ql3-worker\/Dockerfile\s+target: runtime/,
'OCI evidence CI must build independent control, control-ai, admin, local and worker images',
);
requirePattern(
source,
/docker\/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4/,
'OCI evidence CI must pin the reviewed QEMU action',
);
requirePattern(
source,
/docker\/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4/,
'OCI evidence CI must pin the reviewed Buildx action',
);
requirePattern(
source,
/--platform linux\/amd64,linux\/arm64[\s\S]*--target \$\{\{ matrix\.target \}\}[\s\S]*--attest type=provenance,mode=max[\s\S]*--attest type=sbom[\s\S]*--output type=oci/,
'OCI evidence CI must build both platforms with SBOM and maximum provenance',
);
requirePattern(
source,
/ql3-cluster-oci-layout-audit\.cjs[\s\S]*--expected-revision="\$\{\{ github\.sha \}\}"/,
'OCI evidence CI must audit the digest graph against the source revision',
);
requireOccurrences(
source,
/--image=local/g,
2,
'local image CI must generate and inventory-check the exact local SBOM profile',
);
return {
images: ['control', 'control-ai', 'admin', 'local', 'worker'],
nativeArchitectures: ['amd64', 'arm64'],
runtimeInventory: true,
clusterAdminProductFacade: true,
clusterAdminOperatorContext: true,
clusterAdminContextPreflight: true,
clusterAdminContextReadiness: true,
releaseVersionAudit: true,
deploymentLockMaterialization: true,
ociAttestations: true,
osVulnerabilityScan: {
scanner: 'trivy@0.70.0',
severities: ['HIGH', 'CRITICAL'],
packageTypes: ['os'],
ignoreUnfixed: false,
},
};
}
function auditReleaseWorkflow(source) {
const workflow = yaml.load(source);
const candidateJob = workflow?.jobs?.['release-candidate'];
const evidenceJob = workflow?.jobs?.['worker-management-release-evidence'];
const drEvidenceJob = workflow?.jobs?.['cluster-dr-release-evidence'];
const osVulnerabilityJob = workflow?.jobs?.['os-vulnerability'];
const publishJob = workflow?.jobs?.publish;
const releaseSetJob = workflow?.jobs?.['release-set'];
if (
publishJob?.strategy?.matrix?.include !==
'${{ fromJSON(needs.release-candidate.outputs.publish-matrix) }}'
) {
throw new Error(
'publisher matrix must come only from the source-derived release candidate contract',
);
}
if (
osVulnerabilityJob?.strategy?.matrix?.include !==
'${{ fromJSON(needs.release-candidate.outputs.os-matrix) }}' ||
osVulnerabilityJob?.needs !== 'release-candidate' ||
osVulnerabilityJob?.strategy?.['fail-fast'] !== false ||
osVulnerabilityJob?.['runs-on'] !== '${{ matrix.runner }}' ||
osVulnerabilityJob?.['timeout-minutes'] !== 45 ||
JSON.stringify(osVulnerabilityJob?.permissions) !==
JSON.stringify({ contents: 'read' })
) {
throw new Error(
'release OS vulnerability matrix must come from the source-derived deployment-family contract with read-only authority',
);
}
requirePattern(
source,
/workflow_dispatch:\s*\n\s+inputs:\s*\n\s+version:/,
'release workflow must support an explicit version input',
);
requirePattern(
source,
/release_scope:\s+description: Deployment family to publish\s+required: true\s+default: all\s+type: choice\s+options:\s+- local\s+- cluster\s+- all/,
'release workflow must select one closed local, cluster or all deployment family',
);
if (/^ (?:push|pull_request|schedule):/m.test(source)) {
throw new Error(
'release workflow must require an explicit protected-tag dispatch',
);
}
if (
JSON.stringify(workflow?.permissions) !==
JSON.stringify({ contents: 'read' }) ||
JSON.stringify(candidateJob?.permissions) !==
JSON.stringify({ contents: 'read' }) ||
JSON.stringify(evidenceJob?.permissions) !==
JSON.stringify({ contents: 'read' }) ||
JSON.stringify(drEvidenceJob?.permissions) !==
JSON.stringify({ contents: 'read' }) ||
JSON.stringify(publishJob?.permissions) !==
JSON.stringify({
contents: 'read',
packages: 'write',
'id-token': 'write',
attestations: 'write',
'artifact-metadata': 'write',
}) ||
JSON.stringify(releaseSetJob?.permissions) !==
JSON.stringify({
contents: 'read',
packages: 'write',
'id-token': 'write',
attestations: 'write',
'artifact-metadata': 'write',
})
) {
throw new Error(
'release permissions must keep evidence read-only and grant writes only to gated image and release-set publishers',
);
}
if (
candidateJob?.['runs-on'] !== 'ubuntu-24.04' ||
candidateJob?.['timeout-minutes'] !== 5 ||
JSON.stringify(candidateJob?.outputs) !==
JSON.stringify({
'cluster-evidence-required':
'${{ steps.contract.outputs.cluster-evidence-required }}',
'os-matrix': '${{ steps.contract.outputs.os-matrix }}',
'publish-matrix': '${{ steps.contract.outputs.publish-matrix }}',
}) ||
JSON.stringify(evidenceJob?.['runs-on']) !==
JSON.stringify([
'self-hosted',
'linux',
'ql3-release-evidence-ephemeral',
]) ||
evidenceJob?.environment !== 'ql3-production-release-evidence' ||
evidenceJob?.['timeout-minutes'] !== 10 ||
JSON.stringify(drEvidenceJob?.['runs-on']) !==
JSON.stringify([
'self-hosted',
'linux',
'ql3-release-evidence-ephemeral',
]) ||
drEvidenceJob?.environment !== 'ql3-production-release-evidence' ||
drEvidenceJob?.['timeout-minutes'] !== 10 ||
evidenceJob?.needs !== 'release-candidate' ||
drEvidenceJob?.needs !== 'release-candidate' ||
evidenceJob?.if !==
"needs.release-candidate.outputs.cluster-evidence-required == 'true'" ||
drEvidenceJob?.if !==
"needs.release-candidate.outputs.cluster-evidence-required == 'true'" ||
JSON.stringify(publishJob?.needs) !==
JSON.stringify([
'release-candidate',
'worker-management-release-evidence',
'cluster-dr-release-evidence',
'os-vulnerability',
]) ||
typeof publishJob?.if !== 'string' ||
!/always\(\)[\s\S]*release-candidate\.result == 'success'[\s\S]*os-vulnerability\.result == 'success'[\s\S]*cluster-evidence-required != 'true'[\s\S]*worker-management-release-evidence\.result == 'success'[\s\S]*cluster-dr-release-evidence\.result == 'success'/.test(
publishJob.if,
) ||
JSON.stringify(releaseSetJob?.needs) !==
JSON.stringify(['release-candidate', 'publish']) ||
releaseSetJob?.['runs-on'] !== 'ubuntu-24.04' ||
releaseSetJob?.['timeout-minutes'] !== 20 ||
typeof releaseSetJob?.if !== 'string' ||
!/always\(\)[\s\S]*release-candidate\.result == 'success'[\s\S]*publish\.result == 'success'/.test(
releaseSetJob.if,
)
) {
throw new Error(
'release publisher must always require candidate and OS gates while requiring private HA evidence only for a cluster family; release-set closure must additionally require the complete publish matrix',
);
}
const candidateSteps = candidateJob?.steps;
if (
!Array.isArray(candidateSteps) ||
candidateSteps.length !== 3 ||
candidateSteps[0]?.uses !==
'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803' ||
candidateSteps[0]?.with?.['persist-credentials'] !== false ||
candidateSteps[1]?.uses !==
'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38' ||
candidateSteps[1]?.with?.['node-version'] !== '24.18.0' ||
candidateSteps[2]?.id !== 'contract' ||
!/ql3-release-candidate-contract\.cjs[\s\S]*--mode=create[\s\S]*--version="\$\{RELEASE_VERSION\}"[\s\S]*--source-revision="\$\{GITHUB_SHA\}"[\s\S]*--source-ref="\$\{GITHUB_REF\}"[\s\S]*--release-scope="\$\{RELEASE_SCOPE\}"[\s\S]*GITHUB_OUTPUT/.test(
candidateSteps[2]?.run ?? '',
)
) {
throw new Error(
'release candidate job must derive bounded matrices from the exact tag, revision, version and deployment family',
);
}
const osSteps = osVulnerabilityJob?.steps;
const trivyStep = osSteps?.[7];
const uploadStep = osSteps?.[9];
if (
!Array.isArray(osSteps) ||
osSteps.length !== 10 ||
osSteps[0]?.uses !==
'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803' ||
osSteps[0]?.with?.['persist-credentials'] !== false ||
osSteps[1]?.uses !==
'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38' ||
osSteps[1]?.with?.['node-version'] !== '24.18.0' ||
osSteps[2]?.uses !==
'docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c' ||
!/ql3-image-os-vulnerability-policy\.cjs/.test(osSteps[4]?.run ?? '') ||
!/docker buildx build[\s\S]*--platform linux\/\$\{\{ matrix\.image_arch \}\}[\s\S]*--file \$\{\{ matrix\.dockerfile \}\}[\s\S]*--target \$\{\{ matrix\.target \}\}[\s\S]*--attest type=provenance,mode=max[\s\S]*--attest type=sbom[\s\S]*--output "type=oci,dest=\$\{RUNNER_TEMP\}\/ql3-native\/image\.oci\.tar"/.test(
osSteps[5]?.run ?? '',
) ||
!/ql3-image-os-vulnerability-policy\.cjs[\s\S]*--image=\$\{\{ matrix\.image \}\}[\s\S]*--output=\$\{\{ runner\.temp \}\}\/ql3-\$\{\{ matrix\.image \}\}-\$\{\{ matrix\.image_arch \}\}\.trivyignore\.yaml/.test(
osSteps[6]?.run ?? '',
) ||
trivyStep?.uses !==
'aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25' ||
trivyStep?.['continue-on-error'] !== undefined ||
JSON.stringify(trivyStep?.with) !==
JSON.stringify({
version: 'v0.70.0',
input: '${{ runner.temp }}/ql3-native/image.oci.tar',
scanners: 'vuln',
'vuln-type': 'os',
severity: 'HIGH,CRITICAL',
'ignore-unfixed': 'false',
'exit-code': '1',
format: 'table',
'hide-progress': 'true',
timeout: '10m0s',
cache: 'false',
trivyignores:
'${{ runner.temp }}/ql3-${{ matrix.image }}-${{ matrix.image_arch }}.trivyignore.yaml',
}) ||
!/mkdir "\$\{RUNNER_TEMP\}\/ql3-native\/layout"[\s\S]*tar -xf "\$\{RUNNER_TEMP\}\/ql3-native\/image\.oci\.tar"[\s\S]*-C "\$\{RUNNER_TEMP\}\/ql3-native\/layout"[\s\S]*ql3-image-release-bundle\.cjs[\s\S]*--mode=record-native[\s\S]*--image=\$\{\{ matrix\.image \}\}[\s\S]*--platform=linux\/\$\{\{ matrix\.image_arch \}\}[\s\S]*--layout=\$\{\{ runner\.temp \}\}\/ql3-native\/layout[\s\S]*--expected-revision=\$\{\{ github\.sha \}\}[\s\S]*--evidence=\$\{\{ runner\.temp \}\}\/ql3-native\/evidence\.json[\s\S]*rm "\$\{RUNNER_TEMP\}\/ql3-native\/image\.oci\.tar"/.test(
osSteps[8]?.run ?? '',
) ||
uploadStep?.uses !==
'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' ||
JSON.stringify(uploadStep?.with) !==
JSON.stringify({
name: 'ql3-release-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.image }}-${{ matrix.image_arch }}',
path: '${{ runner.temp }}/ql3-native',
'if-no-files-found': 'error',
'retention-days': 1,
'compression-level': 0,
overwrite: false,
'include-hidden-files': false,
})
) {
throw new Error(
'release OS vulnerability job must build once, scan that exact OCI layout tar and upload only bound immutable evidence',
);
}
if (
!Array.isArray(drEvidenceJob?.steps) ||
drEvidenceJob.steps.length !== 3 ||
drEvidenceJob.steps[0]?.uses !==
'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803' ||
drEvidenceJob.steps[0]?.with?.['persist-credentials'] !== false ||
drEvidenceJob.steps[1]?.uses !==
'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38' ||
drEvidenceJob.steps[1]?.with?.['node-version'] !== '24.18.0' ||
typeof drEvidenceJob.steps[2]?.run !== 'string'
) {
throw new Error(
'private disaster-recovery evidence job must contain only the reviewed credential-free checkout, Node setup and audit steps',
);
}
const publishSteps = publishJob?.steps;
const mergeIndex = publishSteps?.findIndex(
(step) => step.id === 'bundle' && /--mode=merge/.test(step.run || ''),
);
const loginIndex = publishSteps?.findIndex(
(step) =>
step.uses ===
'docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c',
);
const importIndex = publishSteps?.findIndex(
(step) => step.id === 'push' && /image import/.test(step.run || ''),
);
const recordIndex = publishSteps?.findIndex((step) =>
/Record the fully verified image/.test(step.name || ''),
);
const recordUploadIndex = publishSteps?.findIndex(
(step) =>
step.uses ===
'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' &&
/same-run verified image record/.test(step.name || ''),
);
if (
!Array.isArray(publishSteps) ||
publishSteps[0]?.uses !==
'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803' ||
publishSteps[0]?.with?.['persist-credentials'] !== false ||
mergeIndex < 0 ||
loginIndex <= mergeIndex ||
importIndex <= loginIndex ||
recordIndex !== publishSteps.length - 2 ||
recordUploadIndex !== publishSteps.length - 1 ||
publishSteps.some((step) => /\bimage copy\b/.test(step.run || '')) ||
publishSteps.some(
(step) =>
step.uses?.startsWith('docker/build-push-action@') ||
/(?:^|\n)\s*docker (?:build|buildx build)\b/.test(step.run || ''),
)
) {
throw new Error(
'privileged image publisher must re-audit, import and verify the scanned bundle without any rebuild or tag promotion before release-set closure',
);
}
if (
!/ql3-release-set-contract\.cjs[\s\S]*--mode=record-image[\s\S]*--version="\$\{RELEASE_VERSION\}"[\s\S]*--source-revision="\$\{GITHUB_SHA\}"[\s\S]*--source-ref="\$\{GITHUB_REF\}"[\s\S]*--release-scope="\$\{RELEASE_SCOPE\}"[\s\S]*--repository-owner="\$\{owner\}"[\s\S]*--candidate="\$\{RUNNER_TEMP\}\/\$\{\{ matrix\.repository \}\}-release-candidate-contract\.json"[\s\S]*--image="\$\{\{ matrix\.image \}\}"[\s\S]*--digest="\$\{DIGEST\}"/.test(
publishSteps[recordIndex]?.run ?? '',
) ||
JSON.stringify(publishSteps[recordUploadIndex]?.with) !==
JSON.stringify({
name: 'ql3-release-record-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.image }}',
path: '${{ runner.temp }}/release-record/${{ matrix.image }}.json',
'if-no-files-found': 'error',
'retention-days': 1,
'compression-level': 0,
overwrite: false,
'include-hidden-files': false,
})
) {
throw new Error(
'each image publisher must upload one exact same-run digest record only after all image verification',
);
}
const releaseSetSteps = releaseSetJob?.steps;
if (
!Array.isArray(releaseSetSteps) ||
releaseSetSteps.length !== 15 ||
releaseSetSteps[0]?.uses !==
'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803' ||
releaseSetSteps[0]?.with?.['persist-credentials'] !== false ||
releaseSetSteps[1]?.uses !==
'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38' ||
releaseSetSteps[1]?.with?.['node-version'] !== '24.18.0' ||
releaseSetSteps[2]?.uses !==
'actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c' ||
JSON.stringify(releaseSetSteps[2]?.with) !==
JSON.stringify({
pattern:
'ql3-release-record-${{ github.run_id }}-${{ github.run_attempt }}-*',
path: '${{ runner.temp }}/release-records',
'merge-multiple': true,
}) ||
releaseSetSteps[3]?.id !== 'release-set' ||
!/ql3-release-candidate-contract\.cjs[\s\S]*--mode=create[\s\S]*ql3-release-set-contract\.cjs[\s\S]*--mode=aggregate[\s\S]*--records="\$\{RUNNER_TEMP\}\/release-records"[\s\S]*ql3-release-set-contract\.cjs[\s\S]*--mode=audit[\s\S]*--report="\$\{report\}"[\s\S]*ql3-release-set-contract\.cjs[\s\S]*--mode=inspect[\s\S]*ql3-release-catalog-contract\.cjs[\s\S]*--mode=plan[\s\S]*--source-repository="\$\{source_repository\}"[\s\S]*--release-set="\$\{report\}"[\s\S]*GITHUB_OUTPUT/.test(
releaseSetSteps[3]?.run ?? '',
) ||
!/v0\.11\.5\/regctl-linux-amd64[\s\S]*c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467[\s\S]*sha256sum --check --strict/.test(
releaseSetSteps[4]?.run ?? '',
) ||
releaseSetSteps[5]?.uses !==
'sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6' ||
releaseSetSteps[6]?.uses !==
'docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c' ||
!/for \(const image of report\.images\)[\s\S]*image\.reference[\s\S]*image\.versionTag, image\.sourceTag[\s\S]*release tag already points at another digest[\s\S]*\['image', 'copy', state\.image\.reference, state\.tag\][\s\S]*promoted tag does not resolve to the release-set digest/.test(
releaseSetSteps[7]?.run ?? '',
) ||
releaseSetSteps[8]?.uses !==
'actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6' ||
JSON.stringify(releaseSetSteps[8]?.with) !==
JSON.stringify({
'subject-path': '${{ steps.release-set.outputs.report }}',
}) ||
releaseSetSteps[9]?.id !== 'catalog' ||
!/artifact put[\s\S]*--artifact-type "\$\{artifact_type\}"[\s\S]*--file-media-type "\$\{file_media_type\}"[\s\S]*--file "\$\{RELEASE_SET\}"[\s\S]*--file-title[\s\S]*--strip-dirs[\s\S]*dev\.qinglong\.release\.scope[\s\S]*org\.opencontainers\.image\.revision[\s\S]*org\.opencontainers\.image\.source[\s\S]*org\.opencontainers\.image\.version[\s\S]*image digest "\$\{discovery_tag\}"[\s\S]*artifact get --file "\$\{file_name\}" "\$\{immutable_reference\}"[\s\S]*cmp --silent "\$\{RELEASE_SET\}" "\$\{roundtrip\}"[\s\S]*manifest get "\$\{immutable_reference\}" --format raw-body[\s\S]*GITHUB_OUTPUT/.test(
releaseSetSteps[9]?.run ?? '',
) ||
!/cosign sign --yes "\$\{CATALOG\}@\$\{DIGEST\}"/.test(
releaseSetSteps[10]?.run ?? '',
) ||
releaseSetSteps[11]?.uses !==
'actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6' ||
JSON.stringify(releaseSetSteps[11]?.with) !==
JSON.stringify({
'subject-name': '${{ steps.catalog.outputs.repository }}',
'subject-digest': '${{ steps.catalog.outputs.digest }}',
'push-to-registry': true,
}) ||
releaseSetSteps[12]?.id !== 'catalog-receipt' ||
!/cosign verify[\s\S]*--certificate-identity "\$\{certificate_identity\}"[\s\S]*--certificate-oidc-issuer "https:\/\/token\.actions\.githubusercontent\.com"[\s\S]*"\$\{CATALOG\}@\$\{DIGEST\}"[\s\S]*gh attestation verify "oci:\/\/\$\{CATALOG\}@\$\{DIGEST\}"[\s\S]*--source-digest "\$\{GITHUB_SHA\}"[\s\S]*--source-ref "\$\{GITHUB_REF\}"[\s\S]*--deny-self-hosted-runners[\s\S]*--bundle-from-oci[\s\S]*ql3-release-catalog-contract\.cjs[\s\S]*--mode=receipt[\s\S]*--manifest-digest="\$\{DIGEST\}"[\s\S]*ql3-release-catalog-contract\.cjs[\s\S]*--mode=audit[\s\S]*GITHUB_OUTPUT/.test(
releaseSetSteps[12]?.run ?? '',
) ||
releaseSetSteps[13]?.uses !==
'actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6' ||
JSON.stringify(releaseSetSteps[13]?.with) !==
JSON.stringify({
'subject-path': '${{ steps.catalog-receipt.outputs.receipt }}',
}) ||
releaseSetSteps[14]?.uses !==
'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a' ||
JSON.stringify(releaseSetSteps[14]?.with) !==
JSON.stringify({
name: 'ql3-release-set-${{ inputs.version }}-${{ inputs.release_scope }}',
path: '${{ steps.release-set.outputs.bundle }}',
'if-no-files-found': 'error',
'retention-days': 90,
'compression-level': 0,
overwrite: false,
'include-hidden-files': false,
})
) {
throw new Error(
'release-set job must download only same-run records, independently inspect, durably publish and attest one no-overwrite deployment lock bundle',
);
}
if (
!Array.isArray(evidenceJob?.steps) ||
evidenceJob.steps.length !== 3 ||
evidenceJob.steps[0]?.uses !==
'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803' ||
evidenceJob.steps[0]?.with?.['persist-credentials'] !== false ||
evidenceJob.steps[1]?.uses !==
'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38' ||
evidenceJob.steps[1]?.with?.['node-version'] !== '24.18.0' ||
typeof evidenceJob.steps[2]?.run !== 'string'
) {
throw new Error(
'private evidence job must contain only the reviewed credential-free checkout, Node setup and audit steps',
);
}
if (/actions\/cache@/.test(source)) {
throw new Error(
'release workflow must never persist private evidence through caches',
);
}
requirePattern(
source,
/GITHUB_REF_TYPE}" != "tag"[\s\S]*GITHUB_REF_NAME}" != "v\$\{RELEASE_VERSION\}"/,
'private evidence gate must bind dispatch version to the exact tag',
);
requireExactOccurrences(
source,
/evidence_dir="\/run\/qinglong3-release-evidence\/\$\{GITHUB_SHA\}"/g,
2,
'the two private evidence jobs must each use exactly one commit-scoped runner mount',
);
requirePattern(
source,
/ql3-worker-credential-management-release-gate\.cjs[\s\S]*--report="\$\{evidence_dir\}\/worker-management-release-evidence\.json"[\s\S]*--ceremony-report="\$\{evidence_dir\}\/worker-management-ceremony\.json"[\s\S]*--durable-audit-report="\$\{evidence_dir\}\/worker-management-durable-audit\.json"[\s\S]*--pki-rotation-report="\$\{evidence_dir\}\/worker-management-pki-rotation-v2\.json"[\s\S]*--ca-rollover-report="\$\{evidence_dir\}\/worker-management-ca-rollover\.json"[\s\S]*--source-commit="\$\{GITHUB_SHA\}"[\s\S]*--release-version="\$\{RELEASE_VERSION\}"/,
'private evidence gate must re-audit the exact five files and bind the release identity',
);
requirePattern(
source,
/ql3-cloudnativepg-backup-audit\.cjs[\s\S]*ql3-barman-cloud-supply-chain-audit\.cjs[\s\S]*ql3-cert-manager-selection-audit\.cjs[\s\S]*ql3-cloudnativepg-dr-release-gate\.cjs[\s\S]*--report="\$\{report\}"[\s\S]*--source-commit="\$\{GITHUB_SHA\}"[\s\S]*--release-version="\$\{RELEASE_VERSION\}"/,
'private disaster-recovery gate must re-audit all static locks and bind the exact report to the release identity',
);
for (const action of [
['actions/checkout', 'd23441a48e516b6c34aea4fa41551a30e30af803', 'v6'],
['actions/setup-node', '249970729cb0ef3589644e2896645e5dc5ba9c38', 'v6'],
[
'docker/setup-buildx-action',
'bb05f3f5519dd87d3ba754cc423b652a5edd6d2c',
'v4',
],
['docker/login-action', '06fb636fac595d6fb4b28a5dfcb21a6f5091859c', 'v4'],
[
'actions/upload-artifact',
'043fb46d1a93c77aae656e7c1c64a875d1fc6a0a',
'v7.0.1',
],
[
'actions/download-artifact',
'3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c',
'v8.0.1',
],
[
'aquasecurity/trivy-action',
'ed142fd0673e97e23eac54620cfb913e5ce36c25',
'v0.36.0',
],
[
'sigstore/cosign-installer',
'6f9f17788090df1f26f669e9d70d6ae9567deba6',
'v4.1.2',
],
['actions/attest', 'f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6', 'v4'],
]) {
const [repository, sha, version] = action;
requirePattern(
source,
new RegExp(
`uses: ${repository.replace(
/[.*+?^${}()|[\]\\]/g,
'\\$&',
)}@${sha} # ${version.replace('.', '\\.')}`,
),
`release workflow is missing immutable action ${repository}@${sha}`,
);
}
requireOccurrences(
source,
/uses: actions\/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6/g,
6,
'all release jobs must pin the reviewed immutable checkout action',
);
requireOccurrences(
source,
/uses: actions\/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6/g,
6,
'all release jobs must pin the reviewed immutable Node setup action',
);
requireOccurrences(
source,
/uses: sigstore\/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4\.1\.2/g,
2,
'image and release-catalog publishers must both pin the reviewed Cosign installer',
);
requirePattern(
source,
/name: Recreate and audit the source-derived release candidate contract[\s\S]*ql3-release-candidate-contract\.cjs[\s\S]*--mode=create[\s\S]*--version="\$\{RELEASE_VERSION\}"[\s\S]*--source-revision="\$\{GITHUB_SHA\}"[\s\S]*--source-ref="\$\{GITHUB_REF\}"[\s\S]*--release-scope="\$\{RELEASE_SCOPE\}"[\s\S]*ql3-release-candidate-contract\.cjs[\s\S]*--mode=audit[\s\S]*--report="\$\{contract\}"/,
'publisher must recreate and independently audit its exact source-derived candidate contract',
);
requirePattern(
source,
/IMAGE_REPOSITORY: \$\{\{ matrix\.repository \}\}[\s\S]*image="ghcr\.io\/\$\{owner\}\/\$\{IMAGE_REPOSITORY\}"/,
'release identity must derive each exact matrix repository',
);
requirePattern(
source,
/ql3-cluster-image-sbom\.cjs\s+--image=\$\{\{ matrix\.image \}\}\s+--output=\$\{\{ runner\.temp \}\}\/\$\{\{ matrix\.repository \}\}\.cdx\.json/,
'release workflow must generate the selected image SBOM',
);
requirePattern(
source,
/npm audit\s+--omit=dev\s+--audit-level=high\s+--prefix=\$\{\{ matrix\.runtime_root \}\}/,
'release workflow must reject high or critical production dependency advisories',
);
requirePattern(
source,
/actions\/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c[\s\S]*name: ql3-release-\$\{\{ github\.run_id \}\}-\$\{\{ github\.run_attempt \}\}-\$\{\{ matrix\.image \}\}-amd64[\s\S]*actions\/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c[\s\S]*name: ql3-release-\$\{\{ github\.run_id \}\}-\$\{\{ github\.run_attempt \}\}-\$\{\{ matrix\.image \}\}-arm64/,
'publisher must download the exact same-run scanned native artifacts',
);
requirePattern(
source,
/ql3-image-release-bundle\.cjs[\s\S]*--mode=merge[\s\S]*--amd64-layout=\$\{RUNNER_TEMP\}\/native\/amd64\/layout[\s\S]*--arm64-layout=\$\{RUNNER_TEMP\}\/native\/arm64\/layout[\s\S]*--expected-revision=\$\{GITHUB_SHA\}[\s\S]*--predicate=\$\{RUNNER_TEMP\}\/\$\{\{ matrix\.repository \}\}-os-vulnerability\.json/,
'publisher must merge and re-audit the two scanned layouts without rebuilding',
);
requirePattern(
source,
/v0\.11\.5\/regctl-linux-amd64[\s\S]*c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467[\s\S]*sha256sum --check --strict/,
'publisher must checksum-pin the exact regctl OCI copier',
);
requireExactOccurrences(
source,
/c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467/g,
2,
'both image and release-set publishers must checksum-pin the exact regctl OCI copier',
);
requirePattern(
source,
/regctl[\s\S]*image import "\$\{IMAGE\}@\$\{DIGEST\}" "\$\{ARCHIVE\}"[\s\S]*image digest "\$\{IMAGE\}@\$\{DIGEST\}"/,
'publisher must import the audited OCI graph by digest without rebuilding or tagging it',
);
requirePattern(
source,
/\^sha256:\[0-9a-f\]\{64\}\$/,
'release workflow must reject malformed image digests',
);
requirePattern(
source,
/cosign sign --yes "\$\{IMAGE\}@\$\{DIGEST\}"/,
'release workflow must keylessly sign the immutable image digest',
);
requireOccurrences(
source,
/uses: actions\/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4/g,
7,
'release workflow must create four image attestations plus release-set, durable catalog and receipt provenance',
);
requireOccurrences(
source,
/push-to-registry: true/g,
5,
'all image and durable-catalog OCI attestations must be pushed beside their subject',
);
requirePattern(
source,
/sbom-path: \$\{\{ runner\.temp \}\}\/\$\{\{ matrix\.repository \}\}\.cdx\.json/,
'release workflow must attest the reviewed application SBOM',
);
requirePattern(
source,
/predicate-type: https:\/\/qinglong\.dev\/attestations\/image-os-vulnerability\/v1\s+predicate-path: \$\{\{ runner\.temp \}\}\/\$\{\{ matrix\.repository \}\}-os-vulnerability\.json/,
'release workflow must attest the digest-bound OS vulnerability evidence',
);
requirePattern(
source,
/predicate-type: https:\/\/qinglong\.dev\/attestations\/release-candidate-contract\/v1\s+predicate-path: \$\{\{ runner\.temp \}\}\/\$\{\{ matrix\.repository \}\}-release-candidate-contract\.json/,
'release workflow must attest the source-derived release candidate contract',
);
requirePattern(
source,
/subject-digest: \$\{\{ steps\.push\.outputs\.digest \}\}/,
'release attestations must bind the pushed digest',
);
requirePattern(
source,
/docker buildx imagetools inspect --raw "\$\{IMAGE\}@\$\{DIGEST\}"[\s\S]*ql3-cluster-remote-manifest-audit\.cjs[\s\S]*--expected-image="\$\{IMAGE\}"[\s\S]*--expected-digest="\$\{DIGEST\}"/,
'release workflow must audit the published digest manifest and attestation bindings',
);
requirePattern(
source,
/name: Verify local rollout compatibility against the pushed digest\s+if: matrix\.image == 'local'[\s\S]*pnpm --filter @qinglong\/local-owner-cli check[\s\S]*docker pull "\$\{IMAGE\}@\$\{DIGEST\}"[\s\S]*ql3-local-compose-rollout-live-contract\.cjs[\s\S]*--image="\$\{IMAGE\}@\$\{DIGEST\}"[\s\S]*--profile=edge[\s\S]*ql3-local-compose-rollout-live-contract\.cjs[\s\S]*--profile=standalone/,
'local release must apply and stop both Profiles against the pushed digest',
);
requirePattern(
source,
/certificate_identity="https:\/\/github\.com\/\$\{GITHUB_REPOSITORY\}\/\.github\/workflows\/ql3-image-release\.yml@\$\{GITHUB_REF\}"[\s\S]*cosign verify[\s\S]*--certificate-identity "\$\{certificate_identity\}"[\s\S]*--certificate-oidc-issuer "https:\/\/token\.actions\.githubusercontent\.com"[\s\S]*"\$\{IMAGE\}@\$\{DIGEST\}"/,
'release workflow must verify the exact keyless workflow identity and OIDC issuer',
);
requireOccurrences(
source,
/gh attestation verify "oci:\/\/\$\{IMAGE\}@\$\{DIGEST\}"/g,
4,
'release workflow must independently verify provenance, CycloneDX, OS vulnerability and candidate attestations',
);
for (const [pattern, finding] of [
[
/--repo "\$\{GITHUB_REPOSITORY\}"/g,
'GitHub attestation verification must bind the repository',
],
[
/--signer-workflow "\$\{GITHUB_REPOSITORY\}\/\.github\/workflows\/ql3-image-release\.yml"/g,
'GitHub attestation verification must bind the signer workflow',
],
[
/--source-digest "\$\{GITHUB_SHA\}"/g,
'GitHub attestation verification must bind the source commit',
],
[
/--source-ref "\$\{GITHUB_REF\}"/g,
'GitHub attestation verification must bind the source ref',
],
[
/--deny-self-hosted-runners/g,
'GitHub attestation verification must reject self-hosted builders',
],
[
/--bundle-from-oci/g,
'GitHub attestation verification must read the published OCI bundle',
],
]) {
requireOccurrences(source, pattern, 5, finding);
}
requirePattern(
source,
/--predicate-type "https:\/\/cyclonedx\.org\/bom"/,
'release workflow must verify the CycloneDX predicate type explicitly',
);
requirePattern(
source,
/--predicate-type "https:\/\/qinglong\.dev\/attestations\/image-os-vulnerability\/v1"/,
'release workflow must verify the OS vulnerability predicate type explicitly',
);
requirePattern(
source,
/--predicate-type "https:\/\/qinglong\.dev\/attestations\/release-candidate-contract\/v1"/,
'release workflow must verify the release candidate predicate type explicitly',
);
requirePattern(
source,
/release-set:\s+name: Close and publish the complete deployment release set[\s\S]*needs:[\s\S]*- publish[\s\S]*name: Promote tags only after the complete set is verified[\s\S]*for \(const image of report\.images\)[\s\S]*image\.versionTag, image\.sourceTag[\s\S]*image', 'copy'[\s\S]*name: Attest the complete release-set file provenance[\s\S]*name: Publish and round-trip the durable OCI release catalog[\s\S]*name: Keylessly sign the immutable release-catalog digest[\s\S]*name: Attest durable release-catalog provenance[\s\S]*name: Verify the durable catalog and create its immutable receipt[\s\S]*name: Attest the immutable release-catalog receipt[\s\S]*name: Publish the deployment digest lock/,
'release tags, durable OCI catalog and deployment bundle must be published only after every selected digest record is complete',
);
return {
trigger: 'explicit protected v3 tag dispatch',
releaseCandidateContract: {
scopes: ['local', 'cluster', 'all'],
workspacePackages: 18,
sourceDerived: true,
digestAttested: true,
localClusterEvidenceRequired: false,
clusterPrivateEvidenceRequired: true,
},
workerManagementEvidence: {
sourceAware: true,
privateEphemeralRunner: true,
maximumAgeSeconds: 86400,
artifactUpload: false,
},
cloudNativePgDisasterRecoveryEvidence: {
sourceAware: true,
privateEphemeralRunner: true,
maximumAgeSeconds: 86400,
artifactUpload: false,
staticLocksReaudited: true,
},
osVulnerabilityScan: {
scanner: 'trivy@0.70.0',
actionCommit: 'ed142fd0673e97e23eac54620cfb913e5ce36c25',
platforms: ['linux/amd64', 'linux/arm64'],
severities: ['HIGH', 'CRITICAL'],
packageTypes: ['os'],
ignoreUnfixed: false,
maximumExceptionDays: 30,
buildOnce: true,
immutableArtifactRetentionDays: 1,
attestedToPublishedDigest: true,
},
images: ['control', 'control-ai', 'admin', 'worker', 'local'],
platforms: ['linux/amd64', 'linux/arm64'],
keylessSignature: true,
buildkitAttestations: ['sbom', 'provenance'],
githubAttestations: [
'provenance',
'sbom',
'os-vulnerability',
'release-candidate',
],
publication: {
copier: 'regctl@0.11.5',
copierSha256:
'c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467',
rebuildAfterScan: false,
tagAfterVerification: true,
tagAfterCompleteReleaseSet: true,
},
releaseSet: {
sourceDerived: true,
sameRunRecords: true,
exactScopeClosure: true,
standaloneInspection: true,
tagPromotionAuthority: 'complete_verified_release_set',
fileProvenanceAttested: true,
artifactRetentionDays: 90,
crossRepositoryAtomicity: false,
},
durableCatalog: {
repository: 'qinglong3-release-catalog',
artifactType: 'application/vnd.qinglong.release-set.v1+json',
basenameOnly: true,
crossRunnerDeterministic: true,
byteExactRoundTrip: true,
keylessSignatureVerified: true,
githubProvenanceVerified: true,
discoveryTagAuthority: 'none',
immutableDigestAuthority: 'verified',
receiptAttested: true,
},
localRolloutPreflight: true,
localRolloutApply: true,
postPublishVerification: [
'manifest',
'cosign',
'provenance',
'cyclonedx',
'os-vulnerability',
'release-candidate',
'release-set',
'durable-catalog',
'release-tags',
],
};
}
function auditClusterImageRelease(root = DEFAULT_ROOT) {
const resolvedRoot = path.resolve(root);
const ci = auditClusterImageCiWorkflow(
readBoundedText(path.join(resolvedRoot, CI_WORKFLOW_PATH)),
readBoundedText(
path.join(
resolvedRoot,
'scripts/ql3-cluster-admin-product-live-contract.cjs',
),
),
);
const release = auditReleaseWorkflow(
readBoundedText(path.join(resolvedRoot, RELEASE_WORKFLOW_PATH)),
);
return { ci, release };
}
function main() {
const report = auditClusterImageRelease(process.argv[2] || DEFAULT_ROOT);
process.stdout.write(`${JSON.stringify({ ok: true, ...report })}\n`);
}
if (require.main === module) {
try {
main();
} catch (error) {
process.stderr.write(
`${JSON.stringify({
ok: false,
error: error instanceof Error ? error.message : String(error),
})}\n`,
);
process.exitCode = 1;
}
}
module.exports = {
auditClusterImageCiWorkflow,
auditClusterImageRelease,
auditReleaseWorkflow,
};
Reference in New Issue View Git Blame Copy Permalink