release-canary.yml

name: RegistryStack Release Canary

on:
  schedule:
    - cron: "19 2 * * *"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: registry-stack-release-canary
  cancel-in-progress: true

jobs:
  control-plane:
    name: Exercise release control plane without public writes
    runs-on: ubuntu-24.04
    permissions:
      attestations: write
      contents: read
      id-token: write
    steps:
      - name: Checkout exact workflow revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          fetch-depth: 0
          persist-credentials: false
          submodules: false

      - name: Exercise dispatch, candidate, advisory, and draft contracts
        shell: bash
        run: |
          set -euo pipefail
          if [[ "${GITHUB_EVENT_NAME}" != "schedule" &&
                "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ]]; then
            echo "Canary accepts only schedule or workflow_dispatch" >&2
            exit 1
          fi
          source_sha="${GITHUB_SHA}"
          workflow_revision="${GITHUB_SHA}"
          version=1.2.3
          release_id=canary
          tag="v${version}"
          created_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
          expires_at="$(date -u -d "${created_at} + 24 hours" +%Y-%m-%dT%H:%M:%SZ)"
          evidence_root=canary/security-evidence
          mkdir -p \
            canary/bundle-root/security \
            "${evidence_root}"/image-sbom \
            "${evidence_root}"/syft \
            "${evidence_root}"/grype
          python3 - "${version}" canary/bundle-root <<'PY'
          import pathlib
          import runpy
          import sys

          version, root_text = sys.argv[1:]
          root = pathlib.Path(root_text)
          inventory = runpy.run_path(
              "release/scripts/release_candidate.py"
          )["_release_payload_inventory"](version)
          for name in inventory:
              (root / name).write_text(
                  f"release canary placeholder: {name}\n",
                  encoding="utf-8",
              )
          PY
          printf '{"spdxVersion":"SPDX-2.3","name":"release-canary"}\n' \
            > canary/bundle-root/registry-stack-${tag}.sbom.spdx.json
          canary_image_names="$(python3 release/scripts/release_candidate.py \
            image-names --version "${version}")"
          read -r -a image_names <<<"${canary_image_names}"

          write_image_reports() {
            local name="$1"
            local image_ref="$2"
            jq -n '{spdxVersion:"SPDX-2.3",packages:[]}' \
              > "${evidence_root}/image-sbom/${name}.spdx.json"
            jq -n \
              --arg image_ref "${image_ref}" \
              '{artifacts:[],source:{type:"image",metadata:{userInput:$image_ref}}}' \
              > "${evidence_root}/syft/${name}.syft.json"
            jq -n \
              --arg image_ref "${image_ref}" \
              '{
                matches: [],
                source: {type:"image",target:{userInput:$image_ref}},
                descriptor: {
                  db: {
                    built:"2026-07-29T00:00:00Z",
                    checksum:("sha256:" + ("0" * 64))
                  }
                }
              }' > "${evidence_root}/grype/${name}.grype.json"
          }
          for name in "${image_names[@]}"; do
            image_ref="ghcr.io/registrystack/${name}-candidate@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
            write_image_reports "${name}" "${image_ref}"
            cp "${evidence_root}/grype/${name}.grype.json" \
              "canary/bundle-root/security/${name}.grype.json"
          done
          jq -n '{status:"valid"}' \
            > "${evidence_root}/grype/grype-db-status.json"
          jq -n '{
            schema_version:"registry-stack.advisory-verdict.v2",
            verdict:"passed",
            subjects:($ARGS.positional | map(. + "-image"))
          }' --args "${image_names[@]}" > "${evidence_root}/advisory-verdict.json"
          cp "${evidence_root}/advisory-verdict.json" \
            canary/bundle-root/security/advisory-verdict.json
          evidence_name="registry-stack-${tag}-security-evidence.tar.gz"
          tar --sort=name --mtime="UTC 1970-01-01" --owner=0 --group=0 \
            --numeric-owner -czf "canary/bundle-root/${evidence_name}" \
            -C "${evidence_root}" \
              image-sbom syft grype advisory-verdict.json
          sbom_sha="$(sha256sum canary/bundle-root/registry-stack-${tag}.sbom.spdx.json | awk '{print $1}')"
          docs_sha="$(sha256sum canary/bundle-root/registry-docs-${tag}.tar.gz | awk '{print $1}')"
          evidence_sha="$(sha256sum "canary/bundle-root/${evidence_name}" | awk '{print $1}')"
          advisory_sha="$(sha256sum canary/bundle-root/security/advisory-verdict.json | awk '{print $1}')"
          sbom_size="$(stat -c %s canary/bundle-root/registry-stack-${tag}.sbom.spdx.json)"
          evidence_size="$(stat -c %s "canary/bundle-root/${evidence_name}")"
          python3 - "${version}" canary/bundle-root canary/payloads.json <<'PY'
          import hashlib
          import json
          import pathlib
          import runpy
          import sys

          version, root_text, output_text = sys.argv[1:]
          root = pathlib.Path(root_text)
          inventory = runpy.run_path(
              "release/scripts/release_candidate.py"
          )["_release_payload_inventory"](version)
          payloads = []
          for name, kind in sorted(inventory.items()):
              payload = (root / name).read_bytes()
              payloads.append(
                  {
                      "name": name,
                      "kind": kind,
                      "size": len(payload),
                      "sha256": hashlib.sha256(payload).hexdigest(),
                  }
              )
          pathlib.Path(output_text).write_text(
              json.dumps(payloads, indent=2) + "\n",
              encoding="utf-8",
          )
          PY
          python3 release/scripts/rstack_components.py --version "${version}" \
            < canary/payloads.json > canary/components.json
          for name in "${image_names[@]}"; do
            jq -n \
              --arg name "${name}" \
              --arg tag "${tag}" \
              '{
                name:$name,
                candidate_ref:(
                  "ghcr.io/registrystack/" + $name +
                  "-candidate@sha256:" + ("a" * 64)
                ),
                digest:("sha256:" + ("a" * 64)),
                final_ref:("ghcr.io/registrystack/" + $name + ":" + $tag)
              }'
          done | jq -s . > canary/images.json
          for name in "${image_names[@]}"; do
            scan="canary/bundle-root/security/${name}.grype.json"
            jq -n \
              --arg image "${name}" \
              --arg name "security/${name}.grype.json" \
              --arg sha256 "$(sha256sum "${scan}" | awk '{print $1}')" \
              '{image:$image,name:$name,sha256:$sha256,status:"passed"}'
          done | jq -s . > canary/scans.json
          tar --sort=name --mtime="UTC 1970-01-01" --owner=0 --group=0 \
            --numeric-owner -czf canary/registry-stack-${tag}-candidate.tar.gz \
            -C canary/bundle-root .
          bundle_sha="$(sha256sum canary/registry-stack-${tag}-candidate.tar.gz | awk '{print $1}')"
          bundle_size="$(stat -c %s canary/registry-stack-${tag}-candidate.tar.gz)"
          jq -n \
            --arg repository "${GITHUB_REPOSITORY}" \
            --arg version "${version}" \
            --arg release_id "${release_id}" \
            --arg tag "${tag}" \
            --arg source_sha "${source_sha}" \
            --arg workflow_revision "${workflow_revision}" \
            --argjson run_id "${GITHUB_RUN_ID}" \
            --argjson run_attempt "${GITHUB_RUN_ATTEMPT}" \
            --arg created_at "${created_at}" \
            --arg expires_at "${expires_at}" \
            --arg docs_sha "${docs_sha}" \
            --arg sbom_sha "${sbom_sha}" \
            --argjson sbom_size "${sbom_size}" \
            --arg evidence_name "${evidence_name}" \
            --arg evidence_sha "${evidence_sha}" \
            --argjson evidence_size "${evidence_size}" \
            --arg advisory_sha "${advisory_sha}" \
            --arg bundle_sha "${bundle_sha}" \
            --argjson bundle_size "${bundle_size}" \
            --slurpfile payloads canary/payloads.json \
            --slurpfile images canary/images.json \
            --slurpfile scans canary/scans.json \
            --slurpfile components canary/components.json \
            '{
              schema_version: "registry-stack.release-candidate.v2",
              repository: $repository,
              release: {
                version: $version,
                release_id: $release_id,
                tag: $tag,
                source_sha: $source_sha
              },
              workflow: {
                path: ".github/workflows/release-candidate.yml",
                revision: $workflow_revision,
                run_id: $run_id,
                run_attempt: $run_attempt
              },
              validity: {
                created_at: $created_at,
                expires_at: $expires_at
              },
              payloads: $payloads[0],
              images: $images[0],
              docs: {
                name: ("registry-docs-" + $tag + ".tar.gz"),
                sha256: $docs_sha
              },
              sbom: {
                name: ("registry-stack-" + $tag + ".sbom.spdx.json"),
                sha256: $sbom_sha
              },
              scans: $scans[0],
              advisory: {
                name: "security/advisory-verdict.json",
                sha256: $advisory_sha,
                verdict: "passed"
              },
              bundle: {
                name: ("registry-stack-" + $tag + "-candidate.tar.gz"),
                size: $bundle_size,
                sha256: $bundle_sha
              },
              components: $components[0]
            }' > canary/candidate-manifest.draft.json
          python3 release/scripts/release_candidate.py seal-candidate \
            --draft canary/candidate-manifest.draft.json \
            --output canary/release-candidate-manifest.json
          jq -n \
            --argjson id "${GITHUB_RUN_ID}" \
            --argjson run_attempt "${GITHUB_RUN_ATTEMPT}" \
            --arg head_sha "${GITHUB_SHA}" \
            --arg created_at "${created_at}" \
            '{
              id: $id,
              run_attempt: $run_attempt,
              event: "repository_dispatch",
              head_sha: $head_sha,
              path: ".github/workflows/release-candidate.yml",
              status: "completed",
              conclusion: "success",
              created_at: $created_at
            }' > canary/trusted-candidate-run.json
          jq -n \
            --argjson id "${GITHUB_RUN_ID}" \
            --argjson run_attempt "${GITHUB_RUN_ATTEMPT}" \
            --arg event "${GITHUB_EVENT_NAME}" \
            --arg head_sha "${GITHUB_SHA}" \
            '{
              id: $id,
              run_attempt: $run_attempt,
              event: $event,
              head_sha: $head_sha,
              path: ".github/workflows/release-canary.yml",
              conclusion: "success",
              completed_at: (now | todateiso8601)
            }' > canary/trusted-canary-run.json
          python3 release/scripts/release_candidate.py verify-candidate \
            --manifest canary/release-candidate-manifest.json \
            --bundle canary/registry-stack-${tag}-candidate.tar.gz \
            --bundle-root canary/bundle-root \
            --source-sha "${source_sha}" \
            --workflow-revision "${workflow_revision}" \
            --version "${version}" \
            --release-id "${release_id}" \
            --run-id "${GITHUB_RUN_ID}" \
            --run-attempt "${GITHUB_RUN_ATTEMPT}" \
            --trusted-run-metadata canary/trusted-candidate-run.json
          python3 release/scripts/release_candidate.py verify-canary \
            --metadata canary/trusted-canary-run.json \
            --workflow-revision "${workflow_revision}"
          jq -n \
            --arg tag "${tag}" \
            --argjson isDraft true \
            --arg name "release-canary-${GITHUB_RUN_ID}" \
            '{tag_name:$tag,name:$name,draft:$isDraft,assets:[]}' \
            > canary/draft-release-api-fixture.json
          jq -e \
            --arg expected "release-canary-${GITHUB_RUN_ID}" \
            '.draft == true and .name == $expected and (.assets | length == 0)' \
            canary/draft-release-api-fixture.json >/dev/null
          (
            cd canary/bundle-root
            find . -type f -print0 | sort -z | xargs -0 sha256sum
          ) > canary/provenance-subjects.sha256
          test -s canary/provenance-subjects.sha256

      - name: Upload canary candidate
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: release-canary-${{ github.run_id }}-${{ github.run_attempt }}
          path: |
            canary/release-candidate-manifest.json
            canary/registry-stack-v1.2.3-candidate.tar.gz
          if-no-files-found: error
          retention-days: 1

      - name: Attest canary only after all local checks pass
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            canary/release-candidate-manifest.json
            canary/registry-stack-v1.2.3-candidate.tar.gz

      - name: Download and authenticate canary candidate
        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with:
          name: release-canary-${{ github.run_id }}-${{ github.run_attempt }}
          path: canary/downloaded

      - name: Verify canary attestation bundle
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          set -euo pipefail
          for subject in \
            canary/downloaded/release-candidate-manifest.json \
            canary/downloaded/registry-stack-v1.2.3-candidate.tar.gz
          do
            gh attestation verify "${subject}" \
              --repo "${GITHUB_REPOSITORY}" \
              --signer-workflow \
                "${GITHUB_REPOSITORY}/.github/workflows/release-canary.yml" \
              --signer-digest "${GITHUB_SHA}" \
              --source-ref refs/heads/main \
              --source-digest "${GITHUB_SHA}" \
              --deny-self-hosted-runners
          done

  macos-contract:
    name: macOS release-tool contract
    runs-on: macos-26
    permissions:
      contents: read
    steps:
      - name: Checkout exact workflow revision
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ github.sha }}
          fetch-depth: 1
          persist-credentials: false
          submodules: false

      - name: Run platform-specific release-tool contract
        shell: bash
        run: |
          set -euo pipefail
          python3 release/scripts/release_candidate.py --help >/dev/null
          release/scripts/registry-release --help >/dev/null
          bash -n release/scripts/build-release-binaries.sh
          bash -n release/scripts/build-release-image.sh