aicr/.github/workflows/evidence-pointer-contract.yaml at main · tjrasche/aicr · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
# Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.  All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Blocking anti-squat gate for the per-source evidence-pointer contract
# (#1347 / #1401). Distinct from the warning-only recipe-evidence.yaml
# (which verifies signatures against OCI): this gate enforces the on-disk
# contract — every committed pointer under recipes/evidence/ must be a
# signed single-attestation V1 pointer that lives under the
# <recipe>/<source>/ directory its own claimed signer hashes to, and whose
# signer is allowlisted as community or partner. It runs with a read-only
# token and no secrets (no OCI/registry access), so it is safe on fork PRs.
#
# This gate is structural, not cryptographic (#1535): it trusts the
# issuer/identity the pointer supplies and does NOT verify a Fulcio/Rekor
# signature binds that identity to the bundle. A pointer that claims a signer
# it does not control passes here but fails cryptographic verification at
# ingest (evidence-ingest.yaml) and is never counted in corroboration. Trust
# derives from that ingest step, not from this gate.

name: "Evidence Pointer Contract"

on:
  pull_request:
    paths:
      - 'recipes/evidence/**'
      - 'pkg/evidence/**'
      - 'tools/evidence-pointercheck/**'
      - '.github/workflows/evidence-pointer-contract.yaml'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  pointer-contract:
    name: Enforce per-source pointer contract
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Load versions
        id: versions
        uses: ./.github/actions/load-versions

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version: ${{ steps.versions.outputs.go }}
          cache: false

      - name: Check evidence pointer contract
        env:
          GOFLAGS: -mod=vendor
        # No --allow-pending: this is the merge gate, so a flat unsigned pending
        # pointer is rejected. It must be signed and relocated under
        # <recipe>/<source>/ (the fork-based sign leg does this) before merge —
        # an unsigned pointer must never land on main, where that leg never runs.
        run: go run ./tools/evidence-pointercheck -root recipes/evidence