ci(supply-chain): retain validated SPDX SBOM evidence - #239

Merged

seonghobae merged 17 commits into

mainfrom

chore/sbom-evidence-20260817

Aug 16, 2026

Commits on Aug 16, 2026

test(supply-chain): require exact locked SPDX SBOM evidence
seonghobae
committed
8fd6c2b
feat(supply-chain): validate SPDX against Cargo lock
seonghobae
committed
a491bf4
ci(supply-chain): generate locked SPDX SBOM
seonghobae
committed
7670aa3
test(supply-chain): exercise SPDX lock validator
seonghobae
committed
0ba0b63
test(supply-chain): run SPDX validator contract
seonghobae
committed
3f8bfe0
test(supply-chain): require full-repository SBOM trigger
seonghobae
committed
8c1aad7
fix(supply-chain): inventory every repository revision
seonghobae
committed
954e120
test(supply-chain): require SBOM artifact handoff verification
seonghobae
committed
0412f3e
ci(supply-chain): reverify retained SBOM artifact
seonghobae
committed
fecf45b
test(recovery): seed processing claim_deadline_at after inbox expiry
seonghobae
committed
612f578
test(sbom): reject malformed SPDX 2.x versions
seonghobae
committed
e3e2e01
fix(sbom): require supported SPDX document versions
seonghobae
committed
f1f63f4
fix(sbom): fail closed on non-string SPDX versions
seonghobae
committed
a25e074
test(sbom): cover incomplete SPDX version marker
seonghobae
committed
b8aaf0b
test(supply-chain): require top-level read-only token authority
seonghobae
committed
6539d2e
fix(supply-chain): fail closed on workflow token authority
seonghobae
committed
acbdb74
merge(main): reconcile protected anonymous credential lifecycle
seonghobae
committed
948863b