security: gate publication on verified attestations

Author: codeforester

.github/workflows/package.yml

@@ -317,7 +317,7 @@ jobs:
 
   publish:
     name: Publish reviewed distribution
-    needs: [build, smoke, provenance]
+    needs: [build, smoke, provenance, verify_attestations]
     if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') || github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -381,9 +381,46 @@ jobs:
           subject-checksums: dist/SHA256SUMS
           sbom-path: dist/SBOM.spdx.json
 
+  verify_attestations:
+    name: Verify reviewed release attestations
+    needs: [build, smoke, provenance, attest]
+    if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') || github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      attestations: read
+    steps:
+      - name: Download reviewed distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: base-cli-dist-${{ github.run_id }}
+          path: dist
+
+      - name: Verify artifact provenance and SBOM attestations
+        env:
+          SOURCE_COMMIT: ${{ needs.build.outputs.source_commit }}
+          RELEASE_TAG: ${{ needs.build.outputs.release_tag }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          for asset in dist/*.whl dist/*.tar.gz; do
+            gh attestation verify "$asset" \
+              --repo "$GITHUB_REPOSITORY" \
+              --signer-workflow "github.com/$GITHUB_REPOSITORY/.github/workflows/package.yml" \
+              --source-digest "$SOURCE_COMMIT" \
+              --source-ref "refs/tags/$RELEASE_TAG"
+            gh attestation verify "$asset" \
+              --repo "$GITHUB_REPOSITORY" \
+              --signer-workflow "github.com/$GITHUB_REPOSITORY/.github/workflows/package.yml" \
+              --source-digest "$SOURCE_COMMIT" \
+              --source-ref "refs/tags/$RELEASE_TAG" \
+              --predicate-type "https://spdx.dev/Document"
+          done
+
   verify_pypi:
     name: Verify published PyPI metadata
-    needs: [build, publish, attest]
+    needs: [build, publish, verify_attestations]
     if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') || (github.event_name == 'workflow_dispatch' && inputs.publish_target == 'pypi' && inputs.release_tag != '') }}
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -405,7 +442,7 @@ jobs:
 
   release:
     name: Create GitHub Release
-    needs: [build, smoke, provenance, publish, attest, verify_pypi]
+    needs: [build, smoke, provenance, attest, verify_attestations, publish, verify_pypi]
     if: ${{ (github.event_name == 'push' && github.ref_type == 'tag') || (github.event_name == 'workflow_dispatch' && inputs.publish_target == 'pypi' && inputs.release_tag != '') }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -442,6 +479,7 @@ jobs:
           SOURCE_REVISION: ${{ needs.build.outputs.source_commit }}
           RELEASE_TAG: ${{ needs.build.outputs.release_tag }}
           SOURCE_COMMIT: ${{ needs.build.outputs.source_commit }}
+          SOURCE_REF: refs/tags/${{ needs.build.outputs.release_tag }}
         run: |
           set -euo pipefail
           tag="$RELEASE_TAG"
@@ -458,13 +496,13 @@ jobs:
             gh attestation verify "$asset" \
               --repo "$GITHUB_REPOSITORY" \
               --signer-workflow "github.com/$GITHUB_REPOSITORY/.github/workflows/package.yml" \
-              --source-digest "$GITHUB_SHA" \
-              --source-ref "$GITHUB_REF"
+              --source-digest "$SOURCE_COMMIT" \
+              --source-ref "$SOURCE_REF"
             gh attestation verify "$asset" \
               --repo "$GITHUB_REPOSITORY" \
               --signer-workflow "github.com/$GITHUB_REPOSITORY/.github/workflows/package.yml" \
-              --source-digest "$GITHUB_SHA" \
-              --source-ref "$GITHUB_REF" \
+              --source-digest "$SOURCE_COMMIT" \
+              --source-ref "$SOURCE_REF" \
               --predicate-type "https://spdx.dev/Document"
           done
 

tests/test_package_workflow.py

@@ -40,8 +40,8 @@ def test_package_workflow_does_not_replace_published_release_assets() -> None:
     assert "refusing to replace immutable release assets" in verifier
     assert "gh release download" in workflow
     assert "gh attestation verify" in workflow
-    assert '--source-digest "$GITHUB_SHA"' in workflow
-    assert '--source-ref "$GITHUB_REF"' in workflow
+    assert '--source-digest "$SOURCE_COMMIT"' in workflow
+    assert '--source-ref "$SOURCE_REF"' in workflow
     assert '--source-commit "$source_commit"' in workflow
     assert "--clobber" not in workflow
 
@@ -63,7 +63,7 @@ def test_package_workflow_gates_tag_publication_on_release_documentation() -> No
     assert "python scripts/validate_release_docs.py" in workflow
     assert "scripts/verify_pypi_metadata.py" in workflow
     assert "name: Verify published PyPI metadata" in workflow
-    assert "needs: [build, smoke, provenance, publish, attest, verify_pypi]" in workflow
+    assert "needs: [build, smoke, provenance, attest, verify_attestations, publish, verify_pypi]" in workflow
 
 
 def test_package_workflow_gates_writes_on_release_provenance() -> None:
@@ -73,6 +73,24 @@ def test_package_workflow_gates_writes_on_release_provenance() -> None:
     assert "name: Verify reviewed release provenance" in workflow
     assert 'git fetch --no-tags --prune origin "refs/heads/main:refs/remotes/origin/main"' in workflow
     assert "python scripts/validate_release_provenance.py" in workflow
-    assert jobs["publish"]["needs"] == ["build", "smoke", "provenance"]
+    assert jobs["publish"]["needs"] == ["build", "smoke", "provenance", "verify_attestations"]
     assert jobs["attest"]["needs"] == ["build", "smoke", "provenance"]
-    assert jobs["release"]["needs"] == ["build", "smoke", "provenance", "publish", "attest", "verify_pypi"]
+    assert jobs["release"]["needs"] == [
+        "build",
+        "smoke",
+        "provenance",
+        "attest",
+        "verify_attestations",
+        "publish",
+        "verify_pypi",
+    ]
+
+
+def test_package_workflow_verifies_attestations_before_publication() -> None:
+    workflow = (Path(__file__).resolve().parents[1] / ".github/workflows/package.yml").read_text(encoding="utf-8")
+    jobs = yaml.safe_load(workflow)["jobs"]
+
+    assert jobs["publish"]["needs"] == ["build", "smoke", "provenance", "verify_attestations"]
+    assert jobs["verify_attestations"]["needs"] == ["build", "smoke", "provenance", "attest"]
+    assert '--source-digest "$SOURCE_COMMIT"' in workflow
+    assert '--source-ref "refs/tags/$RELEASE_TAG"' in workflow