feat(release-evidence): [INFRA-689] add release evidence action and scripts - #303
Merged
Conversation
…est-only - add a release-evidence job to the three examples that create a real bundle - warn inline that deleting a bundle is scaffolding, never a pipeline pattern
…ver got - an open PR rendered "merged UTC" with no date - the approval control was claimed with no approvers, or with only the author
Dispatch-only job outside the jfrog-test-deploy group, so the runner-only paths can be checked without the publishing pipeline.
- an unapproved PR read as declining to self-approve; now it is a stated gap - a bundle that does not exist rendered a seal over zero files; now it refuses
The distance to a fully promoted bundle is now stated in the gaps table rather than only in prose.
Every example bundle is deleted and rebuilt by its owning workflow, so a target from that set is absent more often than present.
…lobs - oci-typed repositories skipped the docker collapse, so layer blobs and _uploads staging copies were reported as shipped artifacts
arrowplum
changed the title
… exists - Chain-holds prose named a terminal attestation for a bundle with zero promotions - Immutability claim cited promotion records that did not exist - Three tests pin both sides; two fail against the previous behaviour Signed-off-by: Joe Martin <jmartin@aerospike.com>
…missing - Resolve CI tokens and user accounts to one person via the org SAML identity map - DEV and PREVIEW are optional; required gates are TEST, STAGE and a terminal - Replace the aspirational gaps table with INCORRECT and EVIDENCE MISSING sections Signed-off-by: Joe Martin <jmartin@aerospike.com>
- Verdict block first: FAIL names the worst finding, INCOMPLETE counts absent records - Resolve people to Name <email> from the identity map, so a finding names who acted - Separate real failures from thinner chains; publishing to customers untested is a failure Signed-off-by: Joe Martin <jmartin@aerospike.com>
… evidence - Promotion retags the manifest, so every promoted container lost its build link and failed - The join still resolves from the bundle record and the timestamped tag, so nothing is absent Signed-off-by: Joe Martin <jmartin@aerospike.com>
- A retagged clean tag loses build properties the timestamped tag beside it still carries - A container's identity is its digest, so a per-path answer reported a break nobody experiences - Still reports a genuinely absent link, as on the server container Signed-off-by: Joe Martin <jmartin@aerospike.com>
…report - Who acted gains a When column, each cell the timestamp of the record naming that actor - Capture pull request opened_at and per-approval submitted_at, which were being discarded - State what the report is as of, since records keep accruing after a release ships Signed-off-by: Joe Martin <jmartin@aerospike.com>
- The reader is the auditor, so the document no longer narrates what one would ask for Signed-off-by: Joe Martin <jmartin@aerospike.com>
- A person can hold several verified-domain addresses and a promotion may record any of them - The SAML nameId alone made jmartin@ and joem@ two people, hiding a one-person chain - Merge organizationVerifiedDomainEmails into the directory and canonicalise aliases Signed-off-by: Joe Martin <jmartin@aerospike.com>
…iling - Every acting identity emitted a gap, so all 30 audited PROD releases read FAIL in CI - Separation is a reader capability, not a record: the promotion exists and names an actor - The same 9 releases fail either way; 3 report a weaker finding without the directory Signed-off-by: Joe Martin <jmartin@aerospike.com>
- The live check looked for 'What we could prove with more evidence', renamed in 049acc4 - Dispatch-only, so no pull request run caught it going stale - Asserts only sections every bundle target renders, not ones that depend on the findings Signed-off-by: Joe Martin <jmartin@aerospike.com>
Removed section on reading the output from the README.
- Dropped history narration, discovery notes, and comments restating the adjacent code - Kept those naming a mistake: tag separators, vcs on a metadata child, GITHUB_OUTPUT newlines - Output byte-identical on three live releases and on verify-artifact.sh; 94 tests pass
…ct.sh - build_name over bname, bundle_repo over rb_repo, attestation over att, and so on - Every jq --arg is named: $path $sha $build $number $repo, not $p $s $b $n $r - Dropped proj, which duplicated project inside a branch where they cannot differ
josh-aerospike
previously approved these changes
Aug 21, 2026
…tools
- jfrog(), JF_BASE, commit_from, source_repo and digest_hits now match across script and action
- verify-artifact.sh reports commit_from where it said recorded_in, the name the JSON already uses
- Replaced inline ${pair#*:} expansions in the live check with named counter, name and value
josh-aerospike
approved these changes
Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a release evidence action, and wires it into the examples that publish a real release bundle. It reports what an artifact or bundle can prove from the signed records JFrog and GitHub already hold: digests, the bundle seal, promotion history with approvers, SLSA provenance, and the authorizing pull request. It reads only.
The scripts came from the
artifact-evidenceskill in the internalcitrusleaf/agent-skills, so using them from a pipeline needed a cross-repo token. Here they are public and need no credential.INFRA-689
Changes
.github/actions/release-evidence/: the action, a script for a whole release and one for a single artifact, plus unit testsrelease-evidencejob after the bundle is created, and a firm warning that the bundle-deletion job is scaffolding rather than a pipeline patterntest_release-evidence.yaml: a dispatch-only job against a live bundle, outside thejfrog-test-deployconcurrency groupAbsent records are reported as gaps, never implied. A bundle that does not exist is refused rather than rendered as a seal over zero files.
Test plan
example_composable-matrix.yamldispatched end to end, 18 jobs green, document attached to the runtest_release-evidence.yamldispatched, green in 17strunk checkclean