0pt/.gitea/workflows/release.yml

name: Release chain (G17, ADR-W16-003)

# Builds + pushes the 0pt image, then hands off to the shared
# sax3l/siax-templates G17 reference hook for every ADR-W16-003 bar item
# 1-7 (pinned-tool install, SBOM, blocking vuln scan, in-toto attestation,
# scoped-key signing, pubkey verification, AUD0/ST0RE evidence storage).
#
# REPLACES this repo's own ad hoc "P007 pattern" release chain (added
# 2026-09-14). An audit (2026-09-15) found that chain failed most of the
# real promotion bar it claimed to meet: syft/cosign installed via a `curl`
# + freshly-refetched checksums file (not a pinned, out-of-band-verified
# digest -- see siax-templates' `lib/pinned-tools.sh` header for exactly
# why that is not a verified digest), NO vulnerability scan of the built
# digest at all, `cosign sign` on the bare digest only (no in-toto/SLSA
# statement, no source-SHA/build-identity/environment/SBOM-hash bound
# together, no scoped key identity), and evidence committed straight back
# into this same mutable repo (`siax/production-evidence/*.json`,
# `siax/source-bundles/*.json` -- nine such commits already existed in this
# repo's history before this change; deleted in this same PR, superseded by
# the real AUD0 write below). This file keeps ONLY what is genuinely
# 0pt-specific (image name, tag scheme, registry push, Dockerfile) and
# delegates everything else to `.siax/hooks/G17.sh` -> the shared reference
# implementation. See `.siax/hooks/README.md` for the pin status and
# required secrets (none of which were provisioned for the old gate either
# -- see that file's own note).
#
# DELIBERATELY ONE JOB. Gitea 1.26 on this fleet resolves org-level
# secrets (SIAX_CI_TOKEN below is org-level) only for the FIRST job of a
# workflow file -- learned the hard way on sax3l/h0st's and sax3l/aud0's
# own G17 migrations. 0pt does not wire a G20 post-deploy step in this
# pass at all (see `.siax/hooks/README.md` "G20 -- deliberately not wired
# yet": no Coolify application provisioned for 0pt, no `/version`
# endpoint), so the single-job constraint that forces G20 into its own
# workflow file elsewhere does not yet bite here -- documented anyway so a
# future PR adding G20 does not repeat the mistake.

on:
  push:
    branches: [main]
  workflow_dispatch:

env:
  IMAGE_REPO: git.cloud.siax.io/sax3l/0pt
  DOCKERFILE: Dockerfile
  SIAX_TEMPLATES_REPO: sax3l/siax-templates
  # PIN STATUS 2026-09-15: sax3l/siax-templates PR #51
  # (feat/g17-signed-deploy-gate-adr-w16-003) MERGED to main, plus three
  # real follow-up fixes on top -- #56/#57 (SPDX compound-license-
  # expression evaluation, exercised live by this repo's own
  # G17_LICENSE_ALLOW policy in .siax/hooks/G17.sh) and #59 (G20 retry
  # logic -- not used by 0pt yet, but the pin picks up main's current tip
  # rather than an older commit, matching what a fresh migration reviews).
  SIAX_TEMPLATES_REF: main
  SIAX_TEMPLATES_PINNED_SHA: a401880aa19a9bf99fbd796c0be481db2705fcaa
  SIAX_TEMPLATES_DIR: /tmp/siax-templates-g17-ref

jobs:
  release:
    name: Build, push, G17 (SBOM/scan/attest/verify/evidence)
    runs-on: ubuntu-latest
    steps:
      - uses: https://git.siax.io/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4, mirrored + SHA-pinned (SUP-06, same pin n0d/cl0ud/st0re/h0st already use)
        with:
          fetch-depth: 0

      # --- fetch the shared G17 reference implementation -----------------
      # Same authenticated-clone-at-runtime mechanism this repo's OLD
      # release.yml already used SIAX_CI_TOKEN for (the evidence-commit
      # push this PR deletes) -- see .siax/hooks/G17.sh's header for why
      # NOT a `uses:` reusable workflow / submodule / vendored copy. Fails
      # closed if the branch has moved past the exact commit this adapter
      # was reviewed against.
      - name: Fetch siax-templates G17 reference (pinned)
        env:
          SIAX_CI_TOKEN: ${{ secrets.SIAX_CI_TOKEN }}
        run: |
          set -euo pipefail
          rm -rf "$SIAX_TEMPLATES_DIR"
          git clone --quiet --branch "$SIAX_TEMPLATES_REF" \
            "https://oauth2:${SIAX_CI_TOKEN}@git.siax.io/${SIAX_TEMPLATES_REPO}.git" "$SIAX_TEMPLATES_DIR"
          actual_sha="$(git -C "$SIAX_TEMPLATES_DIR" rev-parse HEAD)"
          if [ "$actual_sha" != "$SIAX_TEMPLATES_PINNED_SHA" ]; then
            echo "::error::siax-templates $SIAX_TEMPLATES_REF moved (now $actual_sha, pinned $SIAX_TEMPLATES_PINNED_SHA) -- refusing to run an unreviewed version of the gate. Re-review and update SIAX_TEMPLATES_PINNED_SHA deliberately."
            exit 1
          fi
          chmod +x "$SIAX_TEMPLATES_DIR/ci/v2/reference-hooks/"*.sh "$SIAX_TEMPLATES_DIR/ci/v2/reference-hooks/lib/"*.sh
          echo "siax-templates G17 reference @ $actual_sha (pinned, verified)"

      - name: Resolve SHA + tag (never :latest)
        id: sha
        run: |
          set -euo pipefail
          full="$(git rev-parse HEAD)"
          short="$(git rev-parse --short=12 HEAD)"
          echo "full=$full" >> "$GITHUB_OUTPUT"
          echo "short=$short" >> "$GITHUB_OUTPUT"
          echo "image_tag=sha-$short" >> "$GITHUB_OUTPUT"

      - name: Docker login (git.cloud.siax.io)
        env:
          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          set -euo pipefail
          registry_host="$(echo "$IMAGE_REPO" | cut -d/ -f1)"
          echo "$REGISTRY_TOKEN" | docker login "$registry_host" -u "$REGISTRY_USER" --password-stdin

      - name: Build
        env:
          IMAGE_TAG: ${{ steps.sha.outputs.image_tag }}
        run: |
          set -euo pipefail
          docker build -f "$DOCKERFILE" -t "${IMAGE_REPO}:${IMAGE_TAG}" .

      - name: Push (immutable sha-<12> tag, never :latest)
        env:
          IMAGE_TAG: ${{ steps.sha.outputs.image_tag }}
        run: docker push "${IMAGE_REPO}:${IMAGE_TAG}"

      # --- G17: everything else, delegated -------------------------------
      - name: G17 (bar items 1-7, delegated to siax-templates)
        env:
          ARTIFACT_COMMIT_SHA: ${{ steps.sha.outputs.full }}
          ARTIFACT_IMAGE_TAG: ${{ steps.sha.outputs.image_tag }}
          CI_RUN_ID: ${{ github.run_id }}
          CI_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          G17_COSIGN_KEY: /tmp/0pt-g17-cosign.key
          G17_COSIGN_KEY_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
          AUD0_INGEST_TOKEN: ${{ secrets.AUD0_INGEST_TOKEN }}
          AUD0_TENANT_ID: ${{ secrets.AUD0_TENANT_ID }}
        run: |
          set -euo pipefail
          echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > "$G17_COSIGN_KEY"
          trap 'rm -f "$G17_COSIGN_KEY"' EXIT
          bash .siax/hooks/G17.sh

      # NOTE: deliberately NO `actions/upload-artifact@v4` step here.
      # sax3l/cl0ud's release.yml (run 23340, 2026-09-14) documents that
      # this Gitea instance's act_runner does not reliably support
      # upload-artifact@v4 even with continue-on-error: true, and that it
      # can abort the whole job before later steps run. G17.sh's own AUD0
      # submission (bar item 7, step above) is already the durable evidence
      # record; a convenience local copy is not worth re-triggering that
      # known breakage.