ci: add build provenance for npm, go binaries, and the ghcr image by EricAndrechek · Pull Request #308 · Wave-RF/WaveHouse

EricAndrechek · 2026-06-09T23:57:43Z

Summary

Now that the repo is public, ship signed Sigstore build-provenance attestations for every released artifact:

npm — npm publish --provenance on both the dev and tagged SDK channels (via the existing OIDC id-token, no new secret).
Go binaries — actions/attest-build-provenance over goreleaser's dist/checksums.txt (covers the release archives).
GHCR image — attests the multi-arch manifest digest for both the tagged release (release.yml) and the rolling :dev image (publish-dev.yml), stored in-registry (push-to-registry: true).

Plus verification docs so consumers can use it — gh attestation verify for the image + release archives, the npm provenance badge / npm audit signatures for the SDK — covering the distributed binaries/image, not go install (which builds from source).

Changes

publish-npm.yml, release.yml, publish-dev.yml — the attestation wiring. Action SHA-pinned (@v2.4.0); id-token/attestations perms scoped to the publish jobs; digest-resolve hardened with set -euo pipefail + a non-empty guard.
SECURITY.md, README.md, docs/src/content/docs/deployment.md, clients/ts/README.md — verification guidance.
CHANGELOG.md — [Unreleased] entry + corrected the stale "provenance deferred until public" note.

Testing / validation

actionlint clean; make ci green; both pre-push reviewers (pre-push-reviewer, docs-reviewer) → ship_it.
The attest/publish steps run only on push-to-main (dev) and v*/sdk-v* tags (release), so they're validated post-merge — goreleaser-validate covers the config parse on PRs. The image digest is resolved via docker buildx imagetools inspect (buildx is already set up in both workflows).

Refs #149.

🤖 Generated with Claude Code

- publish-npm.yml: --provenance on both publish steps (dev + release), signed via the existing OIDC id-token (public repo + npm>=11.5.1). - release.yml: attest the goreleaser binaries (subject-checksums on checksums.txt) + the multi-arch GHCR image manifest digest, storing the image attestation in GHCR (push-to-registry). The digest-resolve step guards with `set -euo pipefail` + a non-empty check. - publish-dev.yml: attest the rolling :dev image digest (dev binaries aren't distributed). Adds id-token + attestations write perms. - Docs: verification guidance (SECURITY.md supply-chain, README container section, deployment.md registry/releases, clients/ts/README) for the image + release archives + npm badge — not `go install` (builds from source). CHANGELOG [Unreleased] entry + corrected the stale "provenance deferred until public" note. Pinned actions/attest-build-provenance@v2.4.0. Attest/publish steps run only on push-to-main (dev) and v*/sdk-v* tags (release) — validated post-merge; goreleaser-validate covers config parse. Public repo makes Sigstore attestations free. Refs #149. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-06-09T23:57:51Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d36b2a91-0b8d-44f7-9813-565f3a5bc4ee

📥 Commits

Reviewing files that changed from the base of the PR and between 192b741 and 3207133.

📒 Files selected for processing (8)

.github/workflows/publish-dev.yml
.github/workflows/publish-npm.yml
.github/workflows/release.yml
CHANGELOG.md
README.md
SECURITY.md
clients/ts/README.md
docs/src/content/docs/deployment.md

Cache: Disabled due to Reviews > Disable Cache setting

📝 Walkthrough

Summary by CodeRabbit

Release Notes

Chores
- Enabled signed Sigstore build-provenance attestations for published npm packages, Go binaries, and container images.
Documentation
- Updated guides with verification commands and instructions for build-provenance attestations across all artifact types.

Walkthrough

This PR adds Sigstore build-provenance attestations across all release artifacts: dev container images, release binaries, and npm packages. Workflow permissions are expanded to enable attestation signing and publishing; new steps resolve image digests and call actions/attest-build-provenance. npm publish now includes the --provenance flag. Documentation guides users to verify attestations before deployment.

Changes

Supply Chain Provenance & Verification

Layer / File(s)	Summary
Dev workflow image provenance `.github/workflows/publish-dev.yml`	Adds `id-token` and `attestations` write permissions. After publishing the dev image, resolves its multi-arch manifest digest and attests it to GHCR using `actions/attest-build-provenance`.
Release workflow attestations `.github/workflows/release.yml`	Grants `attestations: write` permission. Adds steps to attest binary provenance from GoReleaser checksums and to resolve, then attest, the multi-arch release image digest to the registry.
npm package provenance `.github/workflows/publish-npm.yml`	Enables `--provenance` flag in both dev and release npm publish steps to attach signed attestations to published `@wavehouse/sdk` packages via npm OIDC trusted publishing.
User verification guidance `CHANGELOG.md`, `README.md`, `SECURITY.md`, `clients/ts/README.md`, `docs/src/content/docs/deployment.md`	Documents attestation coverage for images, binaries, and npm packages. Provides `gh attestation verify` commands and npm audit guidance to enable users to validate signatures before deployment or installation.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related issues

npm publishing: post-launch follow-ups (provenance, release path, latest tag, docs) #268: This PR implements the "enable build provenance" follow-up work described in the issue, adding --provenance to npm publishing and comprehensive attestation coverage across all artifact types.

Suggested reviewers

taitelee

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch provenance

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch provenance

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2026-06-10T00:03:09Z

📚 Docs preview is live → https://7c954382-wavehouse-docs.wave-rf.workers.dev

Commit — 3207133: Merge remote-tracking branch 'origin/main' into provenance
Author — @EricAndrechek
Committed — 2026-06-09 19:52 (UTC-04:00)
Deployed — 2026-06-09 20:09 EDT

The supply-chain bullet said SHA-pinning is "enforced by the repository ruleset" — but it's the `sha_pinning_required` Actions permission setting, not a ruleset rule (neither the branch nor tag ruleset has an action-pinning rule). Corrected the wording. Flagged by the PR-A pre-push review as out-of-scope (it shipped in #308); folding the one-liner in here rather than opening a separate PR. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Fix-up for the `/pm-triage` skill — two changes. ## 1. `board.sh` runs under bash 3.2 (the actual bug) `scripts/board.sh` used `declare -A PRIO/STATUS` (associative arrays), which require **bash ≥4**. The routine invokes plain `bash` = `/bin/bash` 3.2 on macOS, so every board write (`file` / `set-priority` / `set-status`) died with `P0: unbound variable` and was being worked around ad-hoc by re-running under `/opt/local/bin/bash`. Replaced the two maps with `case`-based `_prio_id` / `_status_id` lookup functions, so the script runs **natively under stock /bin/bash 3.2** — no re-exec, no MacPorts/Homebrew dependency, works for teammates too. As a bonus, `set-priority` / `set-status` now validate their value arg (fail-closed, precise message) *before* the network lookup; previously the value was unguarded (would crash under `set -u` on bash 4, or silently send an empty option-id). - All 9 option IDs preserved byte-for-byte. - Clean under `/bin/bash` 3.2 **and** bash 5.2; `shellcheck` clean. - Bad-key paths reject (exit 2) without touching `gh`. ## 2. `SKILL.md` — reconcile merged PRs in the status sweep Adds an explicit step to the status-sweep mode: reconcile **merged** PRs against still-open tracking issues, matching by content (not `Closes #`), and tick completed checklist boxes (leaving partial-progress boxes alone). Codifies the lesson from the #308→#268 miss. ## Test plan - `bash -n` + `shellcheck` clean on both bash versions. - Unit-tested the `case` lookups + bad-key rejection under `/bin/bash` 3.2. - `make ci` green. Resolves the "Tooling (blocks board writes under the routine)" item in the pm-triage `pending.md`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

EricAndrechek and others added 2 commits June 9, 2026 19:52

Merge remote-tracking branch 'origin/main' into provenance

3207133

github-project-automation Bot added this to WaveHouse Task Board Jun 9, 2026

github-project-automation Bot moved this to Backlog in WaveHouse Task Board Jun 9, 2026

github-actions Bot added documentation Improvements or additions to documentation github_actions Pull requests that update GitHub Actions code area/sdk TypeScript SDK (clients/ts/) area/docs Documentation, site/, README area/infra CI, build, deploy, Docker, release labels Jun 9, 2026

EricAndrechek marked this pull request as ready for review June 10, 2026 00:04

EricAndrechek merged commit ab02b02 into main Jun 10, 2026
14 of 16 checks passed

github-actions Bot assigned taitelee Jun 10, 2026

github-project-automation Bot moved this from Backlog to Done in WaveHouse Task Board Jun 10, 2026

EricAndrechek deleted the provenance branch June 10, 2026 00:04

github-actions Bot requested a review from taitelee June 10, 2026 00:04

This was referenced Jun 10, 2026

npm publishing: post-launch follow-ups (provenance, release path, latest tag, docs) #268

Closed

fix(pm-triage): board.sh bash-3.2 fix + merged-PR reconcile step #328

Merged

EricAndrechek linked an issue Jun 10, 2026 that may be closed by this pull request

npm publishing: post-launch follow-ups (provenance, release path, latest tag, docs) #268

Closed

4 tasks

EricAndrechek removed a link to an issue Jun 10, 2026

npm publishing: post-launch follow-ups (provenance, release path, latest tag, docs) #268

Closed

4 tasks

This was referenced Aug 10, 2026

fix(deps): Dependabot lockfiles bypass the minimumReleaseAge cooldown #441

Open

fix(ci): Actions cache exceeds 10GB cap — module cache stored 5x #443

Closed

EricAndrechek mentioned this pull request Aug 31, 2026

build: add -trimpath to release, container, and goreleaser builds #537

Open

Navigation Menu

Uh oh!

ci: add build provenance for npm, go binaries, and the ghcr image - #308

ci: add build provenance for npm, go binaries, and the ghcr image#308
EricAndrechek merged 2 commits into
mainfrom
provenance

EricAndrechek commented Jun 9, 2026

Uh oh!

coderabbitai Bot commented Jun 9, 2026 •

edited

Loading

Review failed

Summary by CodeRabbit

Release Notes

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Suggested reviewers

Uh oh!

github-actions Bot commented Jun 10, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

EricAndrechek commented Jun 9, 2026

Summary

Changes

Testing / validation

Uh oh!

coderabbitai Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Summary by CodeRabbit

Release Notes

Walkthrough

Changes

Estimated code review effort

Possibly related issues

Suggested reviewers

Uh oh!

github-actions Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jun 9, 2026 •

edited

Loading

github-actions Bot commented Jun 10, 2026 •

edited

Loading