ci: publish portable sealed proof bundle

Author: clynbmilio

.github/workflows/prove.yml

@@ -60,19 +60,30 @@ jobs:
             > artifacts/receipt-verification.json
           node scripts/verify-delivery.mjs .
 
+      - name: Prepare portable proof bundle
+        run: |
+          RECEIPT_ID="$(jq -r .receipt_id artifacts/run-result.json)"
+          PORTABLE_RECEIPT="${RECEIPT_ID//:/_}.json"
+          mkdir -p published-receipts
+          cp "receipts/$RECEIPT_ID.json" "published-receipts/$PORTABLE_RECEIPT"
+          jq -n \
+            --arg receipt_id "$RECEIPT_ID" \
+            --arg portable_path "published-receipts/$PORTABLE_RECEIPT" \
+            '{receipt_id: $receipt_id, portable_path: $portable_path}' \
+            > artifacts/receipt-file-map.json
+          tar -czf dependency-cve-audit-proof.tar.gz artifacts receipts
+
       - name: Upload immutable workflow artifact
         uses: actions/upload-artifact@v4
         with:
           name: dependency-cve-audit-proof
-          path: |
-            artifacts/
-            receipts/
+          path: dependency-cve-audit-proof.tar.gz
           if-no-files-found: error
 
       - name: Publish proof branch
         run: |
           git config user.name "Versy Proof Bot"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git add -f artifacts receipts
+          git add -f artifacts published-receipts dependency-cve-audit-proof.tar.gz
           git commit -m "chore(proof): publish sealed CVE audit"
           git push --force origin HEAD:proof