release: attest exact sealed SBOM evidence - #797

Merged

seonghobae merged 48 commits into

mainfrom

release/exact-artifact-sbom-attestation

Aug 20, 2026

Commits on Aug 20, 2026

test(release): define exact-artifact SBOM attestation boundary

seonghobae
authored and
pr-auto-rebase[bot]
committed
5cd281e
ci(release): run exact-artifact attestation contract

seonghobae
authored and
pr-auto-rebase[bot]
committed
78417d6
test(release): bind immutable artifact metadata before signing

seonghobae
authored and
pr-auto-rebase[bot]
committed
5a5c8a8
release: add exact sealed SBOM attestation workflow

seonghobae
authored and
pr-auto-rebase[bot]
committed
1e75745
release: verify inert exact artifact SBOM handoffs

seonghobae
authored and
pr-auto-rebase[bot]
committed
a2e2f40
docs: doctor exact artifact SBOM attestation boundary

seonghobae
authored and
pr-auto-rebase[bot]
committed
0cc7a3b
test: distinguish executable commands from workflow prose

seonghobae
authored and
pr-auto-rebase[bot]
committed
5e0d5d2
test: exercise exact artifact handoff verifier boundaries

seonghobae
authored and
pr-auto-rebase[bot]
committed
3b5ab39
ci: enforce complete exact handoff verifier coverage

seonghobae
authored and
pr-auto-rebase[bot]
committed
73284cd
ci: repair exact artifact handoff contracts

seonghobae
authored and
pr-auto-rebase[bot]
committed
5cde44a
ci: publish PR 797 test-only repair before cleanup

seonghobae
authored and
pr-auto-rebase[bot]
committed
0ab0211
ci: trigger PR 797 repair from pull-request synchronize

seonghobae
authored and
pr-auto-rebase[bot]
committed
c3e9919
fix(ci): verify PR 797 contract repair through immutable Git objects

seonghobae
authored and
pr-auto-rebase[bot]
committed
1d1d6ee
chore(ci): trigger exact PR 797 repair

seonghobae
authored and
pr-auto-rebase[bot]
committed
46e8275
ci: verify and materialize final PR 797 coverage repair

seonghobae
authored and
pr-auto-rebase[bot]
committed
6978cc4
ci: cover final PR 797 verifier branches

seonghobae
authored and
pr-auto-rebase[bot]
committed
a40f3d5
ci: retrigger final PR 797 verifier repair

seonghobae
authored and
pr-auto-rebase[bot]
committed
5b24b31
ci: finalize PR 797 verifier coverage on ready

seonghobae
authored and
pr-auto-rebase[bot]
committed
2bb8413
ci: install final PR 797 coverage repair workflow

seonghobae
authored and
pr-auto-rebase[bot]
committed
b3365c4
test(attestation): bind intake to runtime run identifier

seonghobae
authored and
pr-auto-rebase[bot]
committed
db78da9
ci: add minimal PR 797 finalizer

seonghobae
authored and
pr-auto-rebase[bot]
committed
5a0f71e
ci: trigger minimal PR 797 finalizer

seonghobae
authored and
pr-auto-rebase[bot]
committed
7f1665b
ci: add corrected PR 797 finalizer

seonghobae
authored and
pr-auto-rebase[bot]
committed
da72f9e
ci: trigger corrected PR 797 finalizer

seonghobae
authored and
pr-auto-rebase[bot]
committed
75a2275
test: complete exact artifact handoff coverage

github-actions[bot]
authored and
pr-auto-rebase[bot]
committed
fd76f52
docs(release): record exact artifact SBOM attestation

seonghobae
authored and
pr-auto-rebase[bot]
committed
f96e0b4
test(attestation): capture current review regressions

seonghobae
authored and
pr-auto-rebase[bot]
committed
80b85d3
test(attestation): harden strict SBOM evidence contracts

seonghobae
authored and
pr-auto-rebase[bot]
committed
2b3f2f8
fix(attestation): enforce strict CycloneDX subject identity

seonghobae
authored and
pr-auto-rebase[bot]
committed
296c537
test(attestation): bound shell-run contract parsing

seonghobae
authored and
pr-auto-rebase[bot]
committed
e8406a8
ci(attestation): pin supported runner image

seonghobae
authored and
pr-auto-rebase[bot]
committed
561aad7
fix(attestation): isolate inputs and seal offline evidence

seonghobae
authored and
pr-auto-rebase[bot]
committed
bdd1108
docs(attestation): document strict identity and offline sealing

seonghobae
authored and
pr-auto-rebase[bot]
committed
20523c3
chore(changelog): record attestation hardening

seonghobae
authored and
pr-auto-rebase[bot]
committed
e5495a8
test(release): capture remaining SBOM attestation review findings

seonghobae
authored and
pr-auto-rebase[bot]
committed
c1f0af3
test(release): execute exact-head SBOM review regressions

seonghobae
authored and
pr-auto-rebase[bot]
committed
da91c61
test(release): isolate symlink-ancestor regression failure

seonghobae
authored and
pr-auto-rebase[bot]
committed
4f600d2
fix(release): reject symlinked evidence-root ancestors

seonghobae
authored and
pr-auto-rebase[bot]
committed
4c2806e
fix(release): export exact attestation verification commands

seonghobae
authored and
pr-auto-rebase[bot]
committed
664c6eb
test(sbom): reject resealed non-CycloneDX predicate

seonghobae
authored and
pr-auto-rebase[bot]
committed
1d730bb
fix(sbom): constrain attestation predicate before signing

seonghobae
authored and
pr-auto-rebase[bot]
committed
e2197d2
test(sbom): complete canonical predicate regression fixture

seonghobae
authored and
pr-auto-rebase[bot]
committed
19a505c
docs(attestation): preserve current-main changelog without overlap

seonghobae
authored and
pr-auto-rebase[bot]
committed
1763e64
docs(attestation): cite RFC 8259 for sealed SBOM JSON

seonghobae
authored and
pr-auto-rebase[bot]
committed
9d4fa5c
fix(coverage): accept only bounded relative requirement includes

seonghobae
authored and
pr-auto-rebase[bot]
committed
78e64cf
guard

seonghobae
authored and
pr-auto-rebase[bot]
committed
5f58677
chore(release): remove rebase sentinel

seonghobae
authored and
pr-auto-rebase[bot]
committed
bbf5519
Merge branch 'main' into release/exact-artifact-sbom-attestation
opencode-agent[bot]
authored
98ca0d7