Harden supply-chain security: SHA-pin actions, tighten verification, strengthen SBOM checks

Pin all GitHub Actions to commit SHAs, add --signer-workflow to attestation
verification, replace shallow SBOM length check with name/version/license
policy checks, fix Dockerfile mislabeled as lockfile, add jq and registry-auth
prerequisites, and add CI self-test workflow (actionlint, shellcheck, YAML
validation).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: InkByteStudio

.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+name: ci
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out source
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Install actionlint
+        run: |
+          ACTIONLINT_VERSION="1.7.7"
+          curl -fsSL -o /tmp/actionlint.tar.gz \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          tar -xzf /tmp/actionlint.tar.gz -C /tmp
+          sudo mv /tmp/actionlint /usr/local/bin/actionlint
+
+      - name: Lint GitHub Actions workflows
+        run: actionlint
+
+      - name: Lint shell scripts
+        run: |
+          sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck >/dev/null
+          shellcheck scripts/*.sh
+
+      - name: Syntax-check shell scripts
+        run: |
+          for f in scripts/*.sh; do
+            bash -n "$f"
+            echo "  $f: syntax OK"
+          done
+
+      - name: Validate YAML templates
+        run: |
+          python3 -c "
+          import yaml, glob, sys
+          errors = 0
+          for f in glob.glob('templates/*.yaml'):
+              try:
+                  yaml.safe_load(open(f))
+                  print(f'  {f}: valid YAML')
+              except yaml.YAMLError as e:
+                  print(f'  {f}: INVALID - {e}', file=sys.stderr)
+                  errors += 1
+          sys.exit(errors)
+          "

.github/workflows/release.yml

@@ -21,14 +21,14 @@ jobs:
 
     steps:
       - name: Check out source
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Log in to GHCR
         run: echo "${{ github.token }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
 
       - name: Build and push image
         id: build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: .
           push: true
@@ -49,7 +49,7 @@ jobs:
           cosign sign --yes "${IMAGE_URI}"
 
       - name: Generate build provenance attestation
-        uses: actions/attest-build-provenance@v3
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
         with:
           subject-name: ${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.build.outputs.digest }}
@@ -71,7 +71,7 @@ jobs:
           syft "${IMAGE_URI}" -o spdx-json=sbom.spdx.json
 
       - name: Generate signed SBOM attestation
-        uses: actions/attest-sbom@v4
+        uses: actions/attest-sbom@07e74fc4e78d1aad915e867f9a094073a9f71527 # v4
         with:
           subject-name: ${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.build.outputs.digest }}

README.md

@@ -29,6 +29,8 @@ Source → Build → Sign (Cosign) → Attest Provenance → Generate SBOM (Syft
 - [Syft](https://github.com/anchore/syft) SBOM generator
 - A container registry (the example uses GHCR)
 - GitHub CLI (`gh`) for attestation verification
+- [`jq`](https://jqlang.github.io/jq/) for SBOM policy evaluation in deploy-verify.sh
+- **Registry authentication** — `gh attestation verify` for OCI images requires read access to the container registry. Run `docker login` before invoking the verification scripts (for GHCR: `echo $GITHUB_TOKEN | docker login ghcr.io -u <user> --password-stdin`)
 
 ## Quick Start
 

scripts/deploy-verify.sh

@@ -1,35 +1,52 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-IMAGE_URI="$1"
+IMAGE_URI="${1:?Usage: deploy-verify.sh IMAGE_URI}"
 REPO="acme/payments-api"
+SIGNER_WORKFLOW="acme/payments-api/.github/workflows/release.yml"
 
 echo "1) Verify Sigstore signature"
 cosign verify \
   --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
-  --certificate-identity-regexp "https://github.com/acme/payments-api/.github/workflows/release.yml@refs/heads/main" \
+  --certificate-identity-regexp "https://github.com/${SIGNER_WORKFLOW}@refs/heads/main" \
   "${IMAGE_URI}" >/dev/null
 
+# Verification uses GitHub API lookup by default (requires network access to
+# api.github.com). For air-gapped or OCI-native verification, add
+# --bundle-from-oci instead of -R. See:
+# https://cli.github.com/manual/gh_attestation_verify
 echo "2) Verify build provenance"
 gh attestation verify \
   "oci://${IMAGE_URI}" \
-  -R "${REPO}" >/dev/null
+  -R "${REPO}" \
+  --signer-workflow "${SIGNER_WORKFLOW}" >/dev/null
 
 echo "3) Verify SBOM attestation"
 gh attestation verify \
   "oci://${IMAGE_URI}" \
   -R "${REPO}" \
+  --signer-workflow "${SIGNER_WORKFLOW}" \
   --predicate-type "https://spdx.dev/Document/v2.3" >/dev/null
 
 echo "4) Pull SBOM payload for policy checks"
 gh attestation verify \
   "oci://${IMAGE_URI}" \
   -R "${REPO}" \
+  --signer-workflow "${SIGNER_WORKFLOW}" \
   --predicate-type "https://spdx.dev/Document/v2.3" \
   --format json \
   --jq '.[].verificationResult.statement.predicate' > verified-sbom.json
 
-# Check that the SBOM contains package data (SPDX uses .packages, CycloneDX uses .components)
-jq -e '.packages // .components | length > 0' verified-sbom.json >/dev/null
+echo "4a) Check SBOM contains package data"
+jq -e '(.packages // .components) | length > 0' verified-sbom.json >/dev/null
+
+echo "4b) Check all packages have non-empty names"
+jq -e '[(.packages // .components)[] | select(.name == null or .name == "")] | length == 0' verified-sbom.json >/dev/null
+
+echo "4c) Check all packages have versions"
+jq -e '[(.packages // .components)[] | select(.versionInfo == null and .version == null)] | length == 0' verified-sbom.json >/dev/null
+
+echo "4d) Check license information is present"
+jq -e '[(.packages // .components)[] | select(.licenseConcluded != null or .licenseDeclared != null or .licenses != null)] | length > 0' verified-sbom.json >/dev/null
 
 echo "All supply-chain checks passed"

templates/pipeline-inventory.yaml

@@ -10,10 +10,13 @@ build:
 dependencies:
   lockfiles:
     - package-lock.json
+  build_manifests:
     - Dockerfile
   third_party_actions:
     - actions/checkout
     - docker/build-push-action
+    - actions/attest-build-provenance
+    - actions/attest-sbom
 artifact:
   type: container-image
   registry: ghcr.io/acme/payments-api

templates/supply-chain-policy.yaml

@@ -14,6 +14,9 @@ provenance:
 sbom:
   predicate_type: https://spdx.dev/Document/v2.3
   must_include_dependencies: true
+  require_package_names: true
+  require_package_versions: true
+  require_license_info: true
 
 exceptions:
   max_duration_hours: 24