@effected/sbom 0.1.0

package/SlsaProvenance.js

@@ -0,0 +1,145 @@
+import { Schema } from "effect";
+
+//#region src/SlsaProvenance.ts
+/**
+* The SLSA Provenance v1 predicate type URI.
+*
+* @public
+*/
+const SLSA_PROVENANCE_V1 = "https://slsa.dev/provenance/v1";
+/**
+* The SLSA build type identifying a GitHub Actions workflow build.
+*
+* @remarks
+* A published **SLSA build-type identifier** — it names a provenance shape, not
+* an Actions runtime detail — which is why it lives with the provenance model
+* rather than in `@effected/github-actions`.
+*
+* @see {@link https://github.com/slsa-framework/github-actions-buildtypes/tree/main/workflow/v1 | workflow/v1}
+*
+* @public
+*/
+const GITHUB_BUILD_TYPE = "https://actions.github.io/buildtypes/workflow/v1";
+/**
+* How the build was invoked, and what it was invoked from.
+*
+* @public
+*/
+var SlsaBuildDefinition = class extends Schema.Class("SlsaBuildDefinition")({
+	/** The build type URI — {@link GITHUB_BUILD_TYPE} for an Actions workflow. */
+	buildType: Schema.String,
+	/** Parameters an external party controls: for Actions, the workflow itself. */
+	externalParameters: Schema.Struct({ 
+	/** The workflow the build ran. */
+workflow: Schema.Struct({
+		/** The git ref the workflow ran on. */
+		ref: Schema.String,
+		/** The repository's browsable URL. */
+		repository: Schema.String,
+		/** The workflow file's path within the repository. */
+		path: Schema.String
+	}) }),
+	/** Parameters the build platform controls. */
+	internalParameters: Schema.Struct({ 
+	/** The Actions-specific half, spelled in the claim names the platform uses. */
+github: Schema.Struct({
+		/** The event that triggered the workflow. */
+		event_name: Schema.String,
+		/** The repository's numeric id. */
+		repository_id: Schema.String,
+		/** The repository owner's numeric id. */
+		repository_owner_id: Schema.String,
+		/** `github-hosted` or `self-hosted`. */
+		runner_environment: Schema.String
+	}) }),
+	/** The artifacts the build consumed — for Actions, the commit it built. */
+	resolvedDependencies: Schema.Array(Schema.Struct({
+		/** A URI naming the dependency. */
+		uri: Schema.String,
+		/** Algorithm to digest; `gitCommit` for a repository. */
+		digest: Schema.Record(Schema.String, Schema.String)
+	}))
+}) {};
+/**
+* Who ran the build, and the record of that run.
+*
+* @public
+*/
+var SlsaRunDetails = class extends Schema.Class("SlsaRunDetails")({
+	/** The build platform's identity. */
+	builder: Schema.Struct({ 
+	/** A URI identifying the builder — the reusable workflow, for Actions. */
+id: Schema.String }),
+	/** Metadata about this particular run. */
+	metadata: Schema.Struct({ 
+	/** A URI locating the run that produced the artifact. */
+invocationId: Schema.String })
+}) {};
+/**
+* The workflow file's path, with the repository prefix and the `@ref` suffix
+* removed: `owner/repo/.github/workflows/x.yml@main` → `.github/workflows/x.yml`.
+*
+* Reproduces upstream's extraction exactly, first occurrence and first `@`
+* included — a divergence here is a divergence in the emitted predicate.
+*/
+const workflowPathOf = (input) => input.workflowRef.replace(`${input.repository}/`, "").split("@")[0] ?? "";
+/**
+* A SLSA Provenance v1 predicate.
+*
+* @example
+* ```ts
+* import { SlsaProvenance } from "@effected/sbom";
+*
+* const provenance = SlsaProvenance.forGitHubWorkflow(claims);
+* ```
+*
+* @public
+*/
+var SlsaProvenance = class SlsaProvenance extends Schema.Class("SlsaProvenance")({
+	/** What was built, and from what. */
+	buildDefinition: SlsaBuildDefinition,
+	/** Who built it, and when. */
+	runDetails: SlsaRunDetails
+}) {
+	/** The predicate type URI a statement carrying this must declare. */
+	static predicateType = SLSA_PROVENANCE_V1;
+	/** The build type this package's GitHub-workflow constructor stamps. */
+	static buildType = GITHUB_BUILD_TYPE;
+	/**
+	* Provenance for a GitHub Actions `workflow/v1` build.
+	*
+	* @remarks
+	* **Total** — a pure projection of its argument. Every value it needs is
+	* already in the input; nothing is read from the environment and nothing can
+	* fail.
+	*/
+	static forGitHubWorkflow(input) {
+		return SlsaProvenance.make({
+			buildDefinition: SlsaBuildDefinition.make({
+				buildType: GITHUB_BUILD_TYPE,
+				externalParameters: { workflow: {
+					ref: input.ref,
+					repository: `${input.serverUrl}/${input.repository}`,
+					path: workflowPathOf(input)
+				} },
+				internalParameters: { github: {
+					event_name: input.eventName,
+					repository_id: input.repositoryId,
+					repository_owner_id: input.repositoryOwnerId,
+					runner_environment: input.runnerEnvironment
+				} },
+				resolvedDependencies: [{
+					uri: `git+${input.serverUrl}/${input.repository}@${input.ref}`,
+					digest: { gitCommit: input.sha }
+				}]
+			}),
+			runDetails: SlsaRunDetails.make({
+				builder: { id: `${input.serverUrl}/${input.jobWorkflowRef}` },
+				metadata: { invocationId: `${input.serverUrl}/${input.repository}/actions/runs/${input.runId}/attempts/${input.runAttempt}` }
+			})
+		});
+	}
+};
+
+//#endregion
+export { GITHUB_BUILD_TYPE, SLSA_PROVENANCE_V1, SlsaBuildDefinition, SlsaProvenance, SlsaRunDetails };