Supply-chain Evidence
Release SBOMs, licenses, NOTICE review, vulnerability and secret scans, digests, provenance, and attestations.
Every TechFabric Harness release tag runs the Release supply-chain evidence
workflow. High or critical dependency advisories, a secret finding, a package
without Apache-2.0 metadata, an incompatible dependency license, a missing
NOTICE file, an import failure, or a digest mismatch blocks the release.
The release gate also compares the canonical file contents of every locally
packed version that already exists on npm with the registry tarball. Changing
package contents without a changeset and version bump therefore fails CI
instead of silently creating source/registry drift.
For the Databricks package, the gate also rejects JavaScript files left in the
ignored dist directory by an older build layout. This keeps local release
artifacts reproducible with clean CI builds and prevents stale generated files
from being included in a tarball accidentally.
Run the same evidence generation locally:
pnpm run build
pnpm run check:supply-chainThe command writes:
| Artifact | Contents |
|---|---|
release-packages/*.tgz | Exact npm package subjects used for attestation |
release-sbom.cdx.json | CycloneDX 1.5 component inventory |
release-license-report.json | Dependency versions, licenses, and package URLs |
release-notice-review.json | Per-package NOTICE digest and attribution review |
release-secret-scan.json | Packed-package secret-pattern scan result |
release-vulnerability-report.json | Complete pnpm audit result and severity totals |
release-provenance.intoto.json | In-toto statement with SLSA v1 build predicate |
release-artifact-digests.json | SHA-256 for every package subject and evidence file |
verify-supply-chain-evidence.mjs recalculates every digest. CI also runs
Gitleaks across repository history. On release tags, GitHub's OIDC identity
signs build-provenance and SBOM attestations for the retained tarballs through
actions/attest-build-provenance and actions/attest-sbom.
Vulnerability waivers
check-vulnerabilities.mjs fails on any high or critical advisory and derives
severity totals from the audit advisories, so pnpm-native waivers apply: list a
CVE under pnpm.auditConfig.ignoreCves in the root package.json only when no
fixed release exists and the issue is otherwise remediated (for example by a
patchedDependencies patch). Every waiver must say why it is safe. Current
waivers: CVE-2025-71329 and CVE-2025-71330 (image-size ICNS/JXL/HEIF
infinite loops; no fixed image-size release exists, so the parsers are fixed
by patches/image-size@2.0.2.patch).
The gate fails closed: if the audit request itself fails (registry error,
timeout, or a non-JSON/incomplete response), it retries with exponential
backoff — VULN_AUDIT_ATTEMPTS (default 3), VULN_AUDIT_RETRY_MS (default
2000, doubling per attempt), VULN_AUDIT_TIMEOUT_MS (default 180000) — and
exits nonzero without writing a report when no attempt completes. A failed
audit can never pass as "zero vulnerabilities".
Evidence artifacts are retained for 90 days in GitHub Actions. Copy them to the
organization's immutable release archive when policy requires longer
retention. npm packages also publish with publishConfig.provenance: true, so
registry consumers can verify the npm provenance statement independently.
Verify a release
Download the release evidence artifact, then run:
node scripts/verify-supply-chain-evidence.mjs
gh attestation verify artifacts/release-packages/*.tgz \
--repo Fabric-Pro/fabric-harnessThe first command verifies local SHA-256 integrity. The second verifies the keyless GitHub attestation identity and repository binding.