dependency-cve-audit-runx/.github/workflows/prove.yml at main · clynbmilio/dependency-cve-audit-runx · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
name: Prove dependency CVE audit

on:
  workflow_dispatch:

permissions:
  contents: write

jobs:
  prove:
    runs-on: ubuntu-latest
    timeout-minutes: 15

    steps:
      - name: Check out delivery
        uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 24

      - name: Run unit tests
        run: node --test skill/dependency-cve-audit/audit.test.mjs

      - name: Validate governed skill
        run: npx --yes @runxhq/cli@0.6.2 doctor skill/dependency-cve-audit --json

      - name: Check out named vulnerable target
        run: git clone --depth 1 --branch v1.2.5 https://github.com/minimistjs/minimist.git target/minimist-v1.2.5

      - name: Run and seal audit
        env:
          RUNX_RECEIPT_SIGN_KID: ${{ vars.RUNX_RECEIPT_SIGN_KID }}
          RUNX_RECEIPT_SIGN_ED25519_SEED_BASE64: ${{ secrets.RUNX_RECEIPT_SIGN_ED25519_SEED_BASE64 }}
          RUNX_RECEIPT_SIGN_ISSUER_TYPE: ci
        run: |
          set -o pipefail
          test -n "$RUNX_RECEIPT_SIGN_KID"
          test -n "$RUNX_RECEIPT_SIGN_ED25519_SEED_BASE64"
          mkdir -p artifacts receipts
          npx --yes @runxhq/cli@0.6.2 skill ./skill/dependency-cve-audit \
            --input "target_dir=$GITHUB_WORKSPACE/target/minimist-v1.2.5" \
            --input "output_dir=$GITHUB_WORKSPACE/artifacts" \
            --input "include_dev=false" \
            --input "target_repository=https://github.com/minimistjs/minimist" \
            --input "target_ref=v1.2.5" \
            --receipt-dir "$GITHUB_WORKSPACE/receipts" \
            --json | tee artifacts/run-result.json

      - name: Verify receipt and delivery
        run: |
          RECEIPT_ID="$(jq -r .receipt_id artifacts/run-result.json)"
          PUBLIC_KEY="$(jq -r .public_key_base64 artifacts/receipt-public-key.json)"
          KID="$(jq -r .kid artifacts/receipt-public-key.json)"
          test -f "receipts/$RECEIPT_ID.json"
          RUNX_RECEIPT_VERIFY_KID="$KID" \
          RUNX_RECEIPT_VERIFY_ED25519_PUBLIC_KEY_BASE64="$PUBLIC_KEY" \
            npx --yes @runxhq/cli@0.6.2 verify --receipt "receipts/$RECEIPT_ID.json" --json \
            > artifacts/receipt-verification.json
          node scripts/verify-delivery.mjs .

      - name: Prepare portable proof bundle
        run: |
          RECEIPT_ID="$(jq -r .receipt_id artifacts/run-result.json)"
          PORTABLE_RECEIPT="${RECEIPT_ID//:/_}.json"
          mkdir -p published-receipts
          cp "receipts/$RECEIPT_ID.json" "published-receipts/$PORTABLE_RECEIPT"
          jq -n \
            --arg receipt_id "$RECEIPT_ID" \
            --arg portable_path "published-receipts/$PORTABLE_RECEIPT" \
            '{receipt_id: $receipt_id, portable_path: $portable_path}' \
            > artifacts/receipt-file-map.json
          tar -czf dependency-cve-audit-proof.tar.gz artifacts receipts

      - name: Upload immutable workflow artifact
        uses: actions/upload-artifact@v4
        with:
          name: dependency-cve-audit-proof
          path: dependency-cve-audit-proof.tar.gz
          if-no-files-found: error

      - name: Publish proof branch
        run: |
          git config user.name "Versy Proof Bot"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add -f artifacts published-receipts dependency-cve-audit-proof.tar.gz
          git commit -m "chore(proof): publish sealed CVE audit"
          git push --force origin HEAD:proof