.gitea/workflows/verify.yml +36−0 View file@@ -0,0 +1,36 @@
1 +
name: Verify integration baseline 2 +
3 +
on: 4 +
push: 5 +
branches: [main] 6 +
pull_request: 7 +
8 +
jobs: 9 +
verify: 10 +
runs-on: ubuntu-latest 11 +
steps: 12 +
- uses: actions/checkout@v4 13 +
- name: Validate baseline JSON 14 +
run: python -m json.tool product/baseline.json >/dev/null 15 +
- name: Validate 16 pinned revisions 16 +
run: python -c 'import json; d=json.load(open("product/baseline.json")); c=d["components"]; assert len(c)==16; assert len({x["repository"] for x in c})==16; assert all(len(x["commitSha"])==40 for x in c)' 17 +
- name: Validate quality and approval policy 18 +
run: | 19 +
python -m json.tool quality/gates.json >/dev/null 20 +
python -m json.tool approvals/policy.json >/dev/null 21 +
python -m json.tool audit/package-layout.json >/dev/null 22 +
- name: Build Audit Package skeleton 23 +
run: | 24 +
mkdir -p dist/audit-package/manifest dist/audit-package/quality dist/audit-package/approvals dist/audit-package/evidence 25 +
cp product/baseline.json dist/audit-package/manifest/product-baseline.json 26 +
cp quality/gates.json dist/audit-package/quality/quality-gates.json 27 +
cp approvals/policy.json dist/audit-package/approvals/approval-policy.json 28 +
cp audit/package-layout.json dist/audit-package/package-layout.json 29 +
find dist/audit-package -type f -exec sha256sum {} + > dist/audit-package/checksums.sha256 30 +
tar -czf dist/A-SW-Audit-Package-skeleton.tar.gz -C dist audit-package 31 +
- name: Upload Audit Package skeleton 32 +
uses: christopherhx/gitea-upload-artifact@v4 33 +
with: 34 +
name: integration-audit-package 35 +
path: dist 36 +
retention-days: 30