Skip to content

ci(trust): OpenSSF Scorecard + SBOM + Sigstore signed releases#1141

Open
gHashTag wants to merge 3 commits into
masterfrom
trust/openssf-sbom-sigstore
Open

ci(trust): OpenSSF Scorecard + SBOM + Sigstore signed releases#1141
gHashTag wants to merge 3 commits into
masterfrom
trust/openssf-sbom-sigstore

Conversation

@gHashTag

@gHashTag gHashTag commented Jun 15, 2026

Copy link
Copy Markdown
Owner

Цель — быстрый прирост «доверенности» (trustworthiness) без затрат

Внедряет три бесплатных GitHub Actions workflow, повышающих верифицируемую безопасность цепочки поставок. Это сильный, конкретный аргумент для грантовых заявок (ФСИ / Сколково) и соответствует ожиданиям ГОСТ Р 56939-2024 (РБПО) и требованиям аудита компонентов для реестра отечественного ПО.

Что добавлено

Workflow Назначение Триггеры
scorecard.yml OpenSSF Scorecard — публичный балл 0–10 по ~18 проверкам безопасности (Branch-Protection, Token-Permissions, Pinned-Dependencies, Signed-Releases, SAST, Vulnerabilities…). Результаты → OpenSSF API + вкладка Security (SARIF). push в master, еженедельно (Пн 06:17 UTC), branch_protection_rule
sbom.yml SBOM — опись зависимостей в форматах SPDX (граф зависимостей) и CycloneDX (Cargo). На релизе — подписанная аттестация + прикрепление к релизу. push в master, релиз, ручной запуск
sign-release.yml Sigstore keyless-подпись всех артефактов релиза (cosign через GitHub OIDC, без долгоживущих ключей; запись в публичный Rekor) + SLSA build-provenance аттестация. публикация релиза, ручной запуск

Принципы

  • Без секретов/ключей: keyless-подпись через GitHub OIDC; управление ключами не требуется.
  • Минимальные права: top-level permissions: read-all / read, повышение только на уровне job.
  • Нулевая стоимость: всё на штатных GitHub Actions.

Бейдж для README (после первого прогона)

[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/gHashTag/t27/badge)](https://scorecard.dev/viewer/?uri=github.com/gHashTag/t27)

Проверка подписи релиза

cosign verify-blob <file> --bundle <file>.sigstore.json \
  --certificate-identity-regexp 'https://github.com/gHashTag/t27/.github/workflows/sign-release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

PR не сливается автоматически — проверьте и слейте вручную. После слияния Scorecard может потребовать включения «branch protection» на master для максимального балла.

@github-actions

github-actions Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

@github-actions

github-actions Bot commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

PR Dashboard

Generated at: 2026-06-15 07:49:38 UTC

Summary

Status Count
Total Open PRs 2
PRs with Failing Checks 0
PRs with All Checks Green 2
READY 1
FAILING 0
PENDING 0

Seal Status

  • ⚠️ STALE -- sha256(compiler.rs)=1953ec73601f != manifest seal=49e55df6d444.
    The committed NMSE numbers were certified against an older compiler.rs.
    Run scripts/reseal-check.sh locally for the two-step reseal command (advisory; not a merge gate).

This was referenced Jun 15, 2026
Closed
Closed
Closed
Closed
Merged
Merged
Merged
gHashTag pushed a commit that referenced this pull request Jun 17, 2026
ci: add OpenSSF Scorecard, SBOM, and release signing workflows (#1141)
df13937 
- scorecard.yml: weekly Scorecard analysis with SARIF upload
- sbom.yml: SPDX SBOM generation on release via syft
- sign-release.yml: cosign/sigstore signing of release artifacts

Closes #1141
gHashTag pushed a commit that referenced this pull request Jun 17, 2026
docs: update Iteration 5 report and scientific gap analysis
16b5ad6 
- Add C backend M4 confirmation (550 files compiled)
- Mark OpenSSF Scorecard workflow as completed (#1141)
- Add Dechant 2024/2025 peer-reviewed pillars
- Document remaining branch cleanup progress (614 → 224 unique)

Refs #1141
gHashTag pushed a commit that referenced this pull request Jun 17, 2026
@claude
feat(igla): Loop 12 — math primitives, Yosys/EDA specs, R-SI-1 backen…
610c806 
…d, June 2026 intel

- fix(bootstrap): regression double-ref in HashMap::get (line 4202)
- fix(bootstrap): 3 remaining unwrap/expect to safe error handling
- fix(bootstrap): formula_eval.rs evaluate() arity mismatch (1 arg, not 2)
- fix(clippy): ASCII check chars().all() to is_ascii()
- fix(clippy): tri crate docs, trios-bridge HeaderValue cfg(test) import
- feat(specs): specs/math/igla_primitives.t27 — softmax, matmul, RoPE, RMS norm, sacred opcode embed
- feat(specs): specs/igla/race/yosys.t27 — equivalence checking + SVA assertion emission
- feat(specs): specs/igla/race/eda.t27 — OpenROAD PPA feedback + phi-weighted scoring
- feat(specs): specs/igla/race/backend.t27 — Booth-encoded multiplier elimination pass
- docs: COMPETITIVE_POSITIONING_IGLA.md updated with June 2026 threats:
  Alpha-RTL, RTLScout, StepPRM-RTL, Veri-Sure, EdgeRazor, FormalRTL EXTREME
- docs: README.md + NOW.md — IGLA spec directory expanded

Closes #1141

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
gHashTag pushed a commit that referenced this pull request Jun 17, 2026
@claude
docs: Wave Loop Report — Iteration 14, Loop 12
2084445 
- Report for Loop 12 IGLA CODER / IGLA RACE
- Regression fix, panic elimination, clippy cleanup, June 2026 intel
- Cooperation variants for Loop 13

Closes #1141

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
gHashTag pushed a commit that referenced this pull request Jun 17, 2026
@claude
feat(igla): Loop 13 — zero production panic vectors, PRM spec, June 2…
bebbd42 
…026 intel

- fix(cli): final signal handler unwraps/expects in tri/src/main.rs
- feat(specs): specs/igla/coder/prm.t27 — Process Reward Model with
  step-level verifiable rewards (syntax, lint, sacred compliance,
  simulation, synthesis, reference match) and phi-weighted scoring
- docs: COMPETITIVE_POSITIONING_IGLA.md updated with 5 new threats:
  EffiSkel, RLVR, LLM4RTL, Interaction Tree Semantics for RISC-V,
  OrpQuant; PRM added as differentiator #2
- docs: README.md broken links fixed (README_RU.md, CLARA-PREPARATION-PLAN)
- docs: Wave Loop Report Loop 13

Closes #1141

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
gHashTag pushed a commit that referenced this pull request Jun 17, 2026
@claude
docs: Loop 14 — competitive intel update, broken link fixes
72d8499 
- docs/COMPETITIVE_POSITIONING_IGLA.md: 7 new competitors tracked:
  HierSVA (arXiv:2606.13706), CHIPCRAFTBRAIN (arXiv:2604.19856),
  FunPRM (arXiv:2601.22249), Unsupervised PRM (arXiv:2605.10158),
  E8 Zenodo (AIMS Ghana), Gray Mereon System (arXiv:2604.00255)
- docs/COMPETITIVE_POSITIONING_IGLA.md: new Physics/Sacred Geometry section
- docs: batch fix broken internal markdown links (RESEARCH_CLAIMS.md,
  AGENTS_ALPHABET.md, NOW.md, TASK_PROTOCOL.md, PUBLICATION_AUDIT.md,
  GITHUB_RING_ISSUES, etc.) — 94 → 66 remaining
- Weak spot audit: 41 unwraps in compiler.rs verified as test-only
  (all inside #[cfg(test)] blocks); zero production panic vectors

Closes #1141

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
gHashTag pushed a commit that referenced this pull request Jun 17, 2026
@claude
docs: Wave Loop Report — Iteration 14, Loop 14
07becd8 
- Loop 14 report: compiler panic audit, 7 new competitors, 28 link fixes
- Cooperation variants for Loop 15

Closes #1141

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This was referenced Jun 19, 2026
Closed
Merged
Closed
This was referenced Jun 28, 2026
Merged
Merged
Draft
Closed
Closed
Merged
Merged
Merged
This was referenced Jul 5, 2026
Merged
Open
Closed
Closed
Closed
Closed
Closed
Closed
Open
Open
Open
Open
@gHashTag

gHashTag commented Jul 6, 2026

Copy link
Copy Markdown
Owner Author

Closing stale PR — clean-up. Reopen if still relevant.

@gHashTag gHashTag closed this Jul 6, 2026
@gHashTag gHashTag reopened this Jul 6, 2026
@github-actions

github-actions Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

📓 NotebookLM Notebook linked to this PR

This notebook contains session context, decisions, and artifacts for this work.

This was referenced Jul 6, 2026
Merged
Open
Merged
Merged
Merged
Draft
Open
Merged
Merged
Open
Open
Open
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gHashTag