docs: storage destinations, fleet selectors, --list, testlab #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: supply-chain | ||
| # Supply-chain integrity gate. Runs on every push/PR and on a weekly schedule | ||
| # so newly-disclosed CVEs in already-pinned dependencies are caught even when | ||
| # the code is not changing. | ||
| on: | ||
| push: | ||
| branches: [main, refactor] | ||
| paths: ["requirements*.txt", "requirements.lock", ".github/workflows/supply-chain.yml"] | ||
| pull_request: | ||
| paths: ["requirements*.txt", "requirements.lock", ".github/workflows/supply-chain.yml"] | ||
| schedule: | ||
| - cron: "0 6 * * 1" # Mondays 06:00 UTC | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| audit: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-python@v5 | ||
| with: | ||
| python-version: "3.13" | ||
| - name: Install pip-tools + pip-audit (pinned) | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| pip install "pip-tools==7.4.1" "pip-audit==2.7.3" "cyclonedx-bom==4.6.1" | ||
| - name: Verify the lockfile is up to date (hash-pinned) | ||
| run: | | ||
| pip-compile --generate-hashes --quiet \ | ||
| --output-file=requirements.lock.generated requirements.txt | ||
| # The committed lock must match what requirements.txt resolves to. | ||
| if ! diff -u <(grep -vE '^\s*#' requirements.lock | sort) \ | ||
| <(grep -vE '^\s*#' requirements.lock.generated | sort); then | ||
| echo "::error::requirements.lock is stale. Run pip-compile --generate-hashes and commit." | ||
| exit 1 | ||
| fi | ||
| - name: Hash-verified install (rejects tampered/substituted artifacts) | ||
| run: pip install --require-hashes --only-binary :all: -r requirements.lock.generated | ||
| - name: Audit for known CVEs (fail on any vulnerability) | ||
| run: pip-audit --strict --requirement requirements.lock.generated | ||
| - name: Generate CycloneDX SBOM | ||
| run: cyclonedx-py requirements requirements.lock.generated --output-format JSON --outfile sbom.json | ||
| - name: Upload SBOM artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: sbom | ||
| path: sbom.json | ||
