Skip to content

Commit c1af181

Browse files
Ibraheem OlasupoIbraheem Olasupo
Ibraheem Olasupo
authored and
Ibraheem Olasupo
committed
Fix CI dependency and workflow reproducibility
1 parent b737069 commit c1af181

44 files changed

Lines changed: 6344 additions & 135 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.coverage 3‎

472 KB
Binary file not shown.

‎.coverage 4‎

472 KB
Binary file not shown.

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -306,7 +306,7 @@ portfolio-full: verify-consolidated-evidence verify-integration-evidence verify-
306306
PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.portfolio verify
307307
PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.portfolio report
308308

309-
final-validation: quality verify-findings-evidence verify-release-evidence verify-lifecycle-evidence verify-consolidated-evidence verify-champions-evidence verify-developer-enablement-evidence verify-integration-evidence portfolio-full
309+
final-validation: quality evidence-full integration-full portfolio-full
310310

311311
security-assurance-full: quality verify-threat-model-evidence verify-api-security-evidence verify-infrastructure-evidence verify-appsec-evidence verify-dynamic-evidence findings-full release-full lifecycle-full developer-enablement-full champions-full evidence-full integration-full
312312

‎outputs/portfolio/README 2.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Portfolio Package
2+
3+
Deterministic portfolio summary package generated from committed security evidence. No deployment credentials, raw scanner secrets, or external service outputs are included.

‎outputs/portfolio/evidence-index 2.json‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
{
2+
"index_type": "evidence",
3+
"items": [
4+
{
5+
"path": "outputs/security/threat-model/evidence-manifest.json",
6+
"sha256": "b2d3277fd3d5a10c27929ada31c5855b084993eab09fd06d3f8f44a4d3939082",
7+
"size_bytes": 3465,
8+
"type": "evidence"
9+
},
10+
{
11+
"path": "outputs/security/api-security/evidence-manifest.json",
12+
"sha256": "9220e28a605114c19f2838e8a503815ca13a68992446125f35b2287278171474",
13+
"size_bytes": 2510,
14+
"type": "evidence"
15+
},
16+
{
17+
"path": "outputs/security/infrastructure/evidence-manifest.json",
18+
"sha256": "8eea5e1dd1bc011c8c3d6e7f65b43c24c67b53d602f671427bbc06f947e03846",
19+
"size_bytes": 9754,
20+
"type": "evidence"
21+
},
22+
{
23+
"path": "outputs/security/appsec/evidence-manifest.json",
24+
"sha256": "6ec21dcc1fa96defb8b11bb64525a5505331e8b5f4d94219970d32fa52ca58f7",
25+
"size_bytes": 3564,
26+
"type": "evidence"
27+
},
28+
{
29+
"path": "outputs/security/dynamic/evidence-manifest.json",
30+
"sha256": "4847dee6f017483d0433c201de76df68123e74c124c8d9a94ba8785e55630e54",
31+
"size_bytes": 2099,
32+
"type": "evidence"
33+
},
34+
{
35+
"path": "outputs/security/findings/evidence-manifest.json",
36+
"sha256": "c77a6e0ccbfcc4771b79f22f2c51be9df3d8d0edd89af1ed4ba595c8b053ab33",
37+
"size_bytes": 7093,
38+
"type": "evidence"
39+
},
40+
{
41+
"path": "outputs/security/release/evidence-manifest.json",
42+
"sha256": "d919f4f1b20a7efc3992107e51ee89755ee671d5e4aead77d99eb819630b3492",
43+
"size_bytes": 3296,
44+
"type": "evidence"
45+
},
46+
{
47+
"path": "outputs/security/lifecycle/evidence-manifest.json",
48+
"sha256": "b3d1c5dfbe875b3ac53848099cc3ac9c7e671d7d51f8db448688206669eb36cf",
49+
"size_bytes": 5829,
50+
"type": "evidence"
51+
},
52+
{
53+
"path": "outputs/security/evidence/evidence-manifest.json",
54+
"sha256": "7852ad20e936c3866f0dc1488896b76e5c633679b0d46219f8dbbe60a52b588b",
55+
"size_bytes": 6303,
56+
"type": "evidence"
57+
},
58+
{
59+
"path": "outputs/security/champions/evidence-manifest.json",
60+
"sha256": "9eb28068ad08dceb8a56598d8038ddd10614e826a63b37a3b754d7365a1c5fad",
61+
"size_bytes": 1762,
62+
"type": "evidence"
63+
},
64+
{
65+
"path": "outputs/security/integration/integration-manifest.json",
66+
"sha256": "6031bfc49f7d0ff326b3a06b060133e766a741fade3d53d82ff8ceebf83b6dec",
67+
"size_bytes": 4620,
68+
"type": "evidence"
69+
}
70+
],
71+
"missing_paths": [],
72+
"schema_version": "1.0",
73+
"valid": true
74+
}

‎outputs/portfolio/evidence-index.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
},
2222
{
2323
"path": "outputs/security/appsec/evidence-manifest.json",
24-
"sha256": "4cb06649a8f7be11ca1ccfffe0d5c3eeb6e06bbe5ee8e94f5bde40f6bfd8cba0",
24+
"sha256": "a927456454ee8bf27437d82e367fc3f7afdaa24d5655bc94eadb3097c5569947",
2525
"size_bytes": 3564,
2626
"type": "evidence"
2727
},
@@ -51,7 +51,7 @@
5151
},
5252
{
5353
"path": "outputs/security/evidence/evidence-manifest.json",
54-
"sha256": "38cd14bac8fc0eb9b6837d6790783e552dd30bcc70dd6a39647aa8e24a1c125c",
54+
"sha256": "398b5f65bafe728498d2773c01ee454d3ad689b030f3523421e138d1e4fc8e14",
5555
"size_bytes": 6303,
5656
"type": "evidence"
5757
},
@@ -63,7 +63,7 @@
6363
},
6464
{
6565
"path": "outputs/security/integration/integration-manifest.json",
66-
"sha256": "f39dcdfd768e1d5d0df7d3c9a1aa3ffcff483605bc7c91cc01857752b3e416ed",
66+
"sha256": "ec0d8c77e33f91d4450a301396b43ef460effc882924b2a7c8a3f85f0a90dcc1",
6767
"size_bytes": 4620,
6868
"type": "evidence"
6969
}

‎outputs/portfolio/portfolio-manifest 2.json‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
{
2+
"archive_limitation": "No archive is created to avoid platform-specific tar metadata drift.",
3+
"as_of_date": "2026-01-01",
4+
"controlled_timestamp": "2026-01-01T00:00:00Z",
5+
"deterministic_archive_created": false,
6+
"generated_artifacts": [
7+
"evidence-index.json",
8+
"milestone-completion.json",
9+
"portfolio-metrics.json",
10+
"portfolio-readiness.json",
11+
"portfolio-summary.json",
12+
"report-index.json",
13+
"security-capability-matrix.json"
14+
],
15+
"git": {
16+
"branch": "main",
17+
"commit": "b737069e8f88",
18+
"dirty": "true"
19+
},
20+
"input_files": {
21+
"config/portfolio/capability-mapping.yaml": {
22+
"path": "config/portfolio/capability-mapping.yaml",
23+
"sha256": "ebe0adc53faea7b0d502824e33651ef08529f7804df36b3b1b984fb4ab5f6e1c"
24+
},
25+
"config/portfolio/portfolio-policy.yaml": {
26+
"path": "config/portfolio/portfolio-policy.yaml",
27+
"sha256": "aaa8b4f2c9ab6202af5d926f172f97922dff8dc345fc8ef0879768c38c1ce585"
28+
},
29+
"config/portfolio/readiness-criteria.yaml": {
30+
"path": "config/portfolio/readiness-criteria.yaml",
31+
"sha256": "4454afb483124032818e4bb669fca918bae5773d2b0fb39c214de84f4b954feb"
32+
},
33+
"config/portfolio/report-policy.yaml": {
34+
"path": "config/portfolio/report-policy.yaml",
35+
"sha256": "b1964f92add7c453bc7611e8a4372412a568a6b3442a7a4a8c08291cb171828a"
36+
}
37+
},
38+
"output_files": {
39+
"evidence-index.json": {
40+
"path": "outputs/security/portfolio/evidence-index.json",
41+
"sha256": "79b292b7e0c7d7f0d665ee5697024d8b3da29bed1a93368876da9fefa34c11f2",
42+
"size_bytes": 2487
43+
},
44+
"milestone-completion.json": {
45+
"path": "outputs/security/portfolio/milestone-completion.json",
46+
"sha256": "86db7066859f0415e3d70aed56edfd788f0e16a54de1e956d5bc7db2d0a5de52",
47+
"size_bytes": 1749
48+
},
49+
"portfolio-metrics.json": {
50+
"path": "outputs/security/portfolio/portfolio-metrics.json",
51+
"sha256": "65b76ddc01fc6bb0942fbc6cb2aaaf9eecb15cd63ad46ee66198fbcbb70df0ff",
52+
"size_bytes": 664
53+
},
54+
"portfolio-readiness.json": {
55+
"path": "outputs/security/portfolio/portfolio-readiness.json",
56+
"sha256": "26a4208670a19af674d180190ba820b4e2c9198c483cdc9ecd24384bc938f946",
57+
"size_bytes": 490
58+
},
59+
"portfolio-summary.json": {
60+
"path": "outputs/security/portfolio/portfolio-summary.json",
61+
"sha256": "5f0c854aa984f6c7496695a0efacdc82e6b3102713fa3cd4fef146996a051419",
62+
"size_bytes": 930
63+
},
64+
"report-index.json": {
65+
"path": "outputs/security/portfolio/report-index.json",
66+
"sha256": "5045376dd2a1656866bb5473489c64148c849f19086c269abe7c534b85963573",
67+
"size_bytes": 3239
68+
},
69+
"security-capability-matrix.json": {
70+
"path": "outputs/security/portfolio/security-capability-matrix.json",
71+
"sha256": "8f0519fca1710abfd3a234eaedcb9ab8844f67f59f5f2b7cffb96cb21ff66a0a",
72+
"size_bytes": 7933
73+
}
74+
},
75+
"portfolio_id": "PF-7b4a8af64ceebed6",
76+
"schema_version": "1.0"
77+
}

‎outputs/portfolio/portfolio-manifest.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
],
1515
"git": {
1616
"branch": "main",
17-
"commit": "d09a9b93c141",
17+
"commit": "b737069e8f88",
1818
"dirty": "true"
1919
},
2020
"input_files": {
@@ -38,7 +38,7 @@
3838
"output_files": {
3939
"evidence-index.json": {
4040
"path": "outputs/security/portfolio/evidence-index.json",
41-
"sha256": "1c599b31216c28f83a6117ac57020a75279a26de98aeaf3594e72be7bb651b4d",
41+
"sha256": "17deecd831176afd0c9675b9d84e53ae71068fffccbac2aa390f1f1c1d729475",
4242
"size_bytes": 2487
4343
},
4444
"milestone-completion.json": {
@@ -58,12 +58,12 @@
5858
},
5959
"portfolio-summary.json": {
6060
"path": "outputs/security/portfolio/portfolio-summary.json",
61-
"sha256": "267d243af2b14826dc76226609c25ffa0a590a73fe4b9597ce9a6cb166e9fa7a",
61+
"sha256": "3453aad6d094b39eca21c7030519cc54858f2c5713f50bd549b20b9d38c4728b",
6262
"size_bytes": 930
6363
},
6464
"report-index.json": {
6565
"path": "outputs/security/portfolio/report-index.json",
66-
"sha256": "37d5e6c30615140877e1f3e3fd43181f74157a910cbbb23b65f41f9bffdd1968",
66+
"sha256": "bda451e234978052dd5087032bdb07f908d9805f1ac62db8e38c1b487800e9b5",
6767
"size_bytes": 3239
6868
},
6969
"security-capability-matrix.json": {
@@ -72,6 +72,6 @@
7272
"size_bytes": 7933
7373
}
7474
},
75-
"portfolio_id": "PF-02a1692e741ed597",
75+
"portfolio_id": "PF-3e95bc47860adfe7",
7676
"schema_version": "1.0"
7777
}

‎outputs/portfolio/portfolio-summary 2.json‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
{
2+
"as_of_date": "2026-01-01",
3+
"canonical_findings": 44,
4+
"capability_count": 25,
5+
"controlled_timestamp": "2026-01-01T00:00:00Z",
6+
"deployment_status": "not_deployed",
7+
"evidence_sources": 11,
8+
"milestones_completed": 14,
9+
"portfolio_id": "PF-7b4a8af64ceebed6",
10+
"portfolio_package": "outputs/portfolio",
11+
"project_name": "DevSecOps Application Security Pipeline",
12+
"readiness_limitations": [
13+
"Application security evidence is locally validated and the platform is not deployed.",
14+
"AWS architecture is a Terraform reference implementation only.",
15+
"Repository 5 integration is contract-only and does not write to another repository.",
16+
"Release decision remains conditional_pass because known non-blocking findings are governed."
17+
],
18+
"readiness_status": "ready_with_limitations",
19+
"release_decision": "conditional_pass",
20+
"reports_indexed": 15,
21+
"schema_version": "1.0",
22+
"source_findings": 46
23+
}

‎outputs/portfolio/portfolio-summary.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"deployment_status": "not_deployed",
77
"evidence_sources": 11,
88
"milestones_completed": 14,
9-
"portfolio_id": "PF-02a1692e741ed597",
9+
"portfolio_id": "PF-3e95bc47860adfe7",
1010
"portfolio_package": "outputs/portfolio",
1111
"project_name": "DevSecOps Application Security Pipeline",
1212
"readiness_limitations": [

0 commit comments

Comments
 (0)