@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.11

package/src/supply-chain/generated-ecr-collector-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-ecr-collector-command.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/generated-ecr-collector-command.ts"],"names":[],"mappings":";;;AA0DA,gFAuyCC;AAj2CD,2CAAkD;AAClD,+EAAwF;AAE3E,QAAA,YAAY,GAAG,QAAiB,CAAC;AAQjC,QAAA,uBAAuB,GAEhC,MAAM,CAAC,MAAM,CAAC;IAChB,aAAa,EAAE;QACb,aAAa,EAAE,UAAU;QACzB,MAAM,EAAE,kEAAkE;QAC1E,MAAM,EACJ,0FAA0F;KAC7F;IACD,WAAW,EAAE;QACX,aAAa,EAAE,UAAU;QACzB,MAAM,EAAE,kEAAkE;QAC1E,MAAM,EACJ,0FAA0F;KAC7F;CACF,CAAC,CAAC;AAEH,SAAS,iBAAiB,CACxB,QAAwD;IAExD,IACE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC;QAClC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC3B,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CACtB,CAAC,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC3C,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC;YACvD,CAAC,+BAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACzC,CAAC,6FAA6F,CAAC,IAAI,CACjG,OAAO,CAAC,MAAM,CACf,CACJ,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,kCAAkC,CAChD,UAKI,EAAE;IAEN,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,IAAI,qCAAqC,CAAC;IACnE,MAAM,sBAAsB,GAC1B,OAAO,CAAC,sBAAsB,IAAI,gCAAgC,CAAC;IACrE,MAAM,QAAQ,GAAG,iBAAiB,CAChC,OAAO,CAAC,QAAQ,IAAI,+BAAuB,CAC5C,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAY,CAAC;IACxD,IACE,CAAC,iEAAiE,CAAC,IAAI,CACrE,eAAe,CAChB;QACD,CAAC,4DAA4D,CAAC,IAAI,CAChE,sBAAsB,CACvB;QACD,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO;;;;;;;;;;;;;;;;;;;;;;;;UAwBC,eAAe;2CACkB,sBAAsB;;uBAE1C,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;sCACZ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;;;+BAG/B,IAAI,CAAC,SAAS,CACzC,IAAA,2CAA0B,EAAC,cAAc,CAAC,CAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyuCF,CAAC;AACF,CAAC"}

package/src/supply-chain/generated-files.d.ts

@@ -0,0 +1,13 @@
+import { type ActionPinInventory } from './action-pins.js';
+import type { ReviewedBuildPermission } from './inventory.js';
+export interface SupplyChainWorkspaceFilePlan {
+    files: Readonly<Record<string, string>>;
+    managed: readonly string[];
+    seeded: readonly string[];
+}
+export declare const FRAMEWORK_REVIEWED_BUILD_PACKAGES: readonly ["@swc/core", "esbuild", "nx", "protobufjs", "sharp", "unrs-resolver"];
+export declare function frameworkReviewedBuildPermissions(): readonly ReviewedBuildPermission[];
+export declare function frameworkActionPinInventory(): ActionPinInventory;
+export declare function renderSupplyChainWorkspaceFiles(input: {
+    generatedAt: string;
+}): SupplyChainWorkspaceFilePlan;

package/src/supply-chain/generated-files.js

@@ -0,0 +1,401 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FRAMEWORK_REVIEWED_BUILD_PACKAGES = void 0;
+exports.frameworkReviewedBuildPermissions = frameworkReviewedBuildPermissions;
+exports.frameworkActionPinInventory = frameworkActionPinInventory;
+exports.renderSupplyChainWorkspaceFiles = renderSupplyChainWorkspaceFiles;
+const deterministic_order_js_1 = require("../deterministic-order.js");
+const action_pins_js_1 = require("../git-policy/action-pins.js");
+const action_pins_js_2 = require("./action-pins.js");
+const blueprint_trust_js_1 = require("./blueprint-trust.js");
+const generated_blueprint_trust_command_js_1 = require("./generated-blueprint-trust-command.js");
+const generated_command_js_1 = require("./generated-command.js");
+const generated_ecr_collector_command_js_1 = require("./generated-ecr-collector-command.js");
+const generated_container_release_command_js_1 = require("./generated-container-release-command.js");
+const generated_scanner_command_js_1 = require("./generated-scanner-command.js");
+const policy_js_1 = require("./policy.js");
+const scanner_js_1 = require("./scanner.js");
+exports.FRAMEWORK_REVIEWED_BUILD_PACKAGES = [
+    '@swc/core',
+    'esbuild',
+    'nx',
+    'protobufjs',
+    'sharp',
+    'unrs-resolver',
+];
+function frameworkReviewedBuildPermissions() {
+    return [
+        {
+            approvedAt: '2026-07-29T00:00:00.000Z',
+            owner: '@empire-builder-kit/framework-maintainers',
+            package: '@swc/core',
+            rationale: 'Nx compilation requires the reviewed SWC native binding installation.',
+            workItem: 'PLAN:5.6/dependency-software-supply-chain',
+        },
+        {
+            approvedAt: '2026-07-29T00:00:00.000Z',
+            owner: '@empire-builder-kit/framework-maintainers',
+            package: 'esbuild',
+            rationale: 'Generated workload-role preflight compilation requires the reviewed esbuild binary installation.',
+            workItem: 'PLAN:5.6/dependency-software-supply-chain',
+        },
+        {
+            approvedAt: '2026-07-29T00:00:00.000Z',
+            owner: '@empire-builder-kit/framework-maintainers',
+            package: 'nx',
+            rationale: 'The generated workspace requires the reviewed Nx native-platform bootstrap.',
+            workItem: 'PLAN:5.6/dependency-software-supply-chain',
+        },
+        {
+            approvedAt: '2026-07-31T00:00:00.000Z',
+            owner: '@empire-builder-kit/framework-maintainers',
+            package: 'protobufjs',
+            rationale: 'The pinned Pulumi random provider requires the reviewed protobufjs schema bootstrap used by generated protected Service ingress.',
+            workItem: 'PLAN:5.7/combined-candidate-hardening',
+        },
+        {
+            approvedAt: '2026-07-29T00:00:00.000Z',
+            owner: '@empire-builder-kit/framework-maintainers',
+            package: 'sharp',
+            rationale: 'Generated Next.js image processing requires the reviewed Sharp and libvips native installation.',
+            workItem: 'PLAN:5.6/dependency-software-supply-chain',
+        },
+        {
+            approvedAt: '2026-07-29T00:00:00.000Z',
+            owner: '@empire-builder-kit/framework-maintainers',
+            package: 'unrs-resolver',
+            rationale: 'Generated workspace lint resolution requires the reviewed native resolver installation.',
+            workItem: 'PLAN:5.6/dependency-software-supply-chain',
+        },
+    ];
+}
+function json(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+function frameworkActionPinInventory() {
+    return {
+        actions: Object.fromEntries(Object.entries(action_pins_js_1.GITHUB_ACTION_PINS).map(([key, pin]) => [
+            key,
+            {
+                ...pin,
+                scope: key === 'nxSetShas'
+                    ? 'framework'
+                    : [
+                        'checkout',
+                        'downloadArtifact',
+                        'pnpmSetup',
+                        'setupNode',
+                        'uploadArtifact',
+                    ].includes(key)
+                        ? 'both'
+                        : 'consumer',
+            },
+        ])),
+        containers: {},
+        schemaVersion: action_pins_js_2.ACTION_PIN_INVENTORY_SCHEMA_VERSION,
+    };
+}
+function renderSupplyChainWorkspaceFiles(input) {
+    const snapshot = (0, blueprint_trust_js_1.createBlueprintTrustSnapshot)({
+        entries: [],
+        generatedAt: input.generatedAt,
+        schemaVersion: blueprint_trust_js_1.BLUEPRINT_TRUST_SCHEMA_VERSION,
+        sequence: 1,
+        source: {
+            kind: 'repository-reviewed',
+            reference: 'initial-empty-snapshot',
+        },
+    });
+    const trustPolicy = {
+        emergencyOverrides: [],
+        generatedReviews: [],
+        maxAgeDays: 30,
+        schemaVersion: blueprint_trust_js_1.BLUEPRINT_TRUST_SCHEMA_VERSION,
+        snapshotDigest: (0, blueprint_trust_js_1.blueprintTrustSnapshotDigest)(snapshot),
+    };
+    const files = {
+        '.github/dependabot.yml': `version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Etc/UTC
+    cooldown:
+      default-days: 3
+      semver-major-days: 14
+    open-pull-requests-limit: 5
+    groups:
+      production-compatible:
+        dependency-type: production
+        update-types: [minor, patch]
+      development-compatible:
+        dependency-type: development
+        update-types: [minor, patch]
+    ignore:
+      - dependency-name: "@empire-builder-kit/*"
+        update-types: [version-update:semver-major]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 3
+    groups:
+      action-pins:
+        patterns: ["*"]
+  - package-ecosystem: docker
+    directories:
+      - "/packages/*/jobs/*"
+      - "/packages/*/migration"
+      - "/packages/*/services/*"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 3
+`,
+        '.github/actions-pins.json': json(frameworkActionPinInventory()),
+        'supply-chain/blueprint-trust-policy.json': json(trustPolicy),
+        'supply-chain/blueprint-trust-snapshot.json': json(snapshot),
+        'supply-chain/build-permissions.json': json({
+            records: frameworkReviewedBuildPermissions(),
+            schemaVersion: policy_js_1.SUPPLY_CHAIN_POLICY_SCHEMA_VERSION,
+        }),
+        'supply-chain/exceptions.json': json({
+            records: [],
+            schemaVersion: policy_js_1.SUPPLY_CHAIN_POLICY_SCHEMA_VERSION,
+        }),
+        'supply-chain/downloaded-tools.json': json({
+            records: [
+                ...Object.entries(scanner_js_1.OSV_SCANNER_RELEASES).map(([platform, release]) => ({
+                    digest: release.sha256,
+                    name: `osv-scanner-${platform}`,
+                    source: `https://github.com/google/osv-scanner/releases/download/v${scanner_js_1.OSV_SCANNER_VERSION}/${release.name}`,
+                    version: scanner_js_1.OSV_SCANNER_VERSION,
+                })),
+                ...Object.entries(generated_ecr_collector_command_js_1.SYFT_COLLECTOR_RELEASES).map(([platform, release]) => ({
+                    digest: release.sha256,
+                    name: `syft-${platform}`,
+                    source: release.source,
+                    version: generated_ecr_collector_command_js_1.SYFT_VERSION,
+                })),
+            ].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.name, right.name)),
+            schemaVersion: policy_js_1.SUPPLY_CHAIN_POLICY_SCHEMA_VERSION,
+        }),
+        'supply-chain/license-policy.json': json({
+            allow: [
+                '0BSD',
+                'Apache-2.0',
+                'Artistic-2.0',
+                'BSD-2-Clause',
+                'BSD-3-Clause',
+                'BlueOak-1.0.0',
+                'CC-BY-4.0',
+                'CC0-1.0',
+                'ISC',
+                'MIT',
+                'MIT-0',
+                'MPL-2.0',
+                'Python-2.0',
+                'Unlicense',
+                'WTFPL',
+            ],
+            deny: [],
+            review: ['LicenseRef-Unknown'],
+            schemaVersion: policy_js_1.SUPPLY_CHAIN_POLICY_SCHEMA_VERSION,
+        }),
+        'supply-chain/vendored-sources.json': json({
+            records: [],
+            schemaVersion: policy_js_1.SUPPLY_CHAIN_POLICY_SCHEMA_VERSION,
+        }),
+        'supply-chain/structural-scanner-input.json': json({
+            kind: 'ebk-supply-chain-scanner-input',
+            licenses: [],
+            requiredCoverage: ['npm', 'container', 'vendored-source'],
+            scanner: {
+                coverage: [],
+                resultSetDigest: '0'.repeat(64),
+                scannedAt: '1970-01-01T00:00:00.000Z',
+                schemaVersion: 2,
+                status: 'unavailable',
+                tool: 'structural-check-only',
+                version: '0',
+            },
+            schemaVersion: 2,
+            subject: {
+                containerInventoryDigest: '0'.repeat(64),
+                lockfileDigest: '0'.repeat(64),
+                repositoryCommit: '0'.repeat(40),
+                resultDigests: [],
+                vendoredRegistryDigest: '0'.repeat(64),
+            },
+            vulnerabilities: [],
+        }),
+        'supply-chain/vulnerability-policy.json': json({
+            block: {
+                critical: ['exposed', 'reachable', 'unknown'],
+                high: ['exposed', 'reachable', 'unknown'],
+                low: [],
+                medium: ['exposed'],
+                unknown: ['exposed', 'not-reachable', 'reachable', 'unknown'],
+            },
+            schemaVersion: policy_js_1.SUPPLY_CHAIN_POLICY_SCHEMA_VERSION,
+        }),
+        'tools/blueprint-trust-check.mjs': (0, generated_blueprint_trust_command_js_1.renderBlueprintTrustCheckCommand)(),
+        'tools/blueprint-verification-vitest.config.mjs': (0, generated_blueprint_trust_command_js_1.renderBlueprintVerificationVitestConfig)(),
+        'tools/container-release.mjs': (0, generated_container_release_command_js_1.renderContainerReleaseCommand)(),
+        'tools/ecr-inspector-collect.mjs': (0, generated_ecr_collector_command_js_1.renderEcrInspectorCollectorCommand)(),
+        'tools/supply-chain-check.mjs': (0, generated_command_js_1.renderSupplyChainCheckCommand)(),
+        'tools/supply-chain-scan.mjs': (0, generated_scanner_command_js_1.renderSupplyChainScannerCommand)(),
+        'supply-chain/README.md': `# Supply-chain policy
+
+Protected checks treat package manifests, the root lockfile, dependency
+lifecycle scripts, GitHub Actions, downloaded tools, container bases, and
+source-vendored inputs as executable supply-chain inputs.
+
+Before adding a direct dependency, record the capability, scope, source,
+license, maintenance and release signals, transitive/install behavior,
+permissions, advisories, alternatives, removal path, and owning team in the
+pull request. Changes to \`allowBuilds\` require a matching exact-package record
+with owner, rationale, work item, and approval time.
+
+The license lists are organization-owned policy, not legal conclusions.
+Unknown and changed licenses require review. Exceptions are exact-component,
+approved, expiring records with compensating controls and recheck triggers.
+
+The Blueprint trust snapshot is offline and report-first. Review snapshot
+bytes and their proposed digest before updating both the snapshot and pinned
+policy digest. Never delete a release to erase its quarantine or revocation
+history. A stale snapshot, missing exact package integrity, quarantined or
+revoked release, or expired override fails protected adoption and deployment.
+The built-in Standard Blueprint is trusted only at the exact installed
+\`@empire-builder-kit/nx\` version. Local authoring Blueprints must become
+exact installed packages with reviewed registry integrity before protected
+deployment.
+
+SBOMs are final-artifact evidence. Store generated CycloneDX JSON and its
+digest with release evidence; do not commit routine build output. Any omitted
+ecosystem or component fails protected SBOM generation.
+
+Protected OCI builds run natively on the reviewed Linux amd64 and arm64
+workers. Each platform tag is deliberately one plain runtime manifest:
+BuildKit's embedded provenance and SBOM attestations are disabled so the tag
+cannot silently become an attestation index. Integrity-pinned Syft inventories
+the exact pushed digest separately, and the retained CycloneDX bytes,
+platform-specific component set, actual default-command behavior, and an
+independently deployed npm production closure are bound into release evidence.
+Architecture-specific operating-system packages may differ; the independent
+npm production closure must not.
+
+Staging assembly creates the dual-architecture index only after validating all
+platform evidence and retained SBOM bytes. Production never rebuilds it.
+Integrity-pinned Crane v${generated_container_release_command_js_1.CRANE_VERSION} recursively copies the reviewed index
+and child manifests from an independently configured staging account and
+Region, and the promotion command proves every resulting production digest.
+The production environment requires
+\`AWS_STAGING_PROMOTION_PULL_ROLE_ARN\`,
+\`AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID\`, and
+\`AWS_STAGING_PROMOTION_REGION\`; staging and production must also define their
+own \`AWS_EXPECTED_ACCOUNT_ID\` and \`AWS_REGION\` variables. The source and target
+accounts must differ.
+
+The v1 executable-action inventory admits only reviewed external actions
+pinned to full Git commit SHAs and Docker actions pinned to immutable image
+digests. Repository-local \`uses: ./...\` actions are rejected instead of
+silently trusted. If local composite actions are added after v1, their nested
+execution graph needs an explicit bounded recursive review contract first.
+
+Default workspace verification runs the explicit
+\`structural-scanner-input.json\` sentinel. Its output records that no scanner
+ran and makes no protected-scan claim. A protected workflow must produce a
+normalized scanner input under \`.ebk/evidence/supply-chain/\` and invoke the
+\`supply-chain-check-protected\` target; unavailable, partial, or missing
+required coverage then fails closed.
+
+The managed scanner downloads OSV-Scanner v${scanner_js_1.OSV_SCANNER_VERSION} only from
+its official GitHub release and verifies the platform-specific SHA-256 before
+execution. It scans the exact pnpm lockfile and every applicable digest-pinned
+container base, revalidates active source-vendored admissions, and binds raw
+results to the repository commit and independently computed inventory. The
+recorded result-set digest identifies the exact queried raw results and pinned
+scanner binary; \`scannedAt\` is the execution time. Neither field claims an
+OSV database publication time or a digest of OSV's online database.
+
+License completeness is evaluated against the explicit supported v1 platform
+matrix (macOS, Linux glibc/musl, and Windows on x64/arm64). The generated pnpm
+\`supportedArchitectures\` policy materializes applicable optional packages so
+their exact package metadata is inspectable. A lock-derived package applicable
+to a supported platform but missing inspected license metadata fails protected
+policy; packages outside the matrix remain explicit non-applicable inventory.
+
+The ECR collector first emits a machine-readable applicability report.
+Protected Service, Job, migration, and retirement task definitions consume the
+exact predeploy dual-architecture OCI binding by digest. The collector
+independently revalidates that deployed index and task-definition environment,
+inventories the actual image with integrity-bound Syft v${generated_ecr_collector_command_js_1.SYFT_VERSION}, and
+exhausts enhanced ECR/Inspector pagination separately for both bound
+\`linux/amd64\` and \`linux/arm64\` child manifests before emitting a
+release-to-component impact query. A tag-only image, missing architecture,
+partial result, substituted release, or stale scan fails closed.
+
+The applicability assessment is a local, read-only contract. The live
+ECR/Inspector and Syft collection path is protected evidence automation, not a
+portable local-development command: v1 reviews Syft binaries only for Linux
+x64 and arm64 and runs collection on a protected Ubuntu worker. Collection
+fails closed on macOS, Windows, or any unreviewed platform; those platforms do
+not provide substitute final-image evidence.
+
+Run the protected \`ECR Inspector evidence\` workflow after a deployment and
+provide its exact successful Deploy run, retained release artifact, Slice,
+artifact, and deployed ECS authority. This manual boundary is explicit because
+the current deploy graph does not expose one trustworthy ECS ARN for every
+supported workload. It is live protected evidence, not part of the local or
+fake-process proof tiers.
+
+Each protected staging and production environment needs a dedicated
+\`AWS_ECR_INSPECTOR_EVIDENCE_ROLE_ARN\` secret. Keep that OIDC role read-only and
+limit it to \`sts:GetCallerIdentity\`, \`ecs:DescribeServices\`,
+\`ecs:DescribeTasks\`, \`ecs:DescribeTaskDefinition\`,
+\`ecr:GetAuthorizationToken\`, \`ecr:DescribeImages\`,
+\`ecr:GetRegistryScanningConfiguration\`,
+\`ecr:DescribeImageScanFindings\`, \`ecr:BatchGetImage\`,
+\`ecr:GetDownloadUrlForLayer\`, and \`ecr:BatchCheckLayerAvailability\` for the
+exact protected account. Scope repository-level actions to only the generated
+repositories; ECR's authorization-token and registry-configuration actions
+retain their required registry-level resource scope. The collector writes
+credentials only to a private temporary Docker configuration removed at exit.
+`,
+    };
+    return {
+        files,
+        managed: [
+            '.github/actions-pins.json',
+            'supply-chain/downloaded-tools.json',
+            'supply-chain/structural-scanner-input.json',
+            'tools/blueprint-trust-check.mjs',
+            'tools/blueprint-verification-vitest.config.mjs',
+            'tools/container-release.mjs',
+            'tools/ecr-inspector-collect.mjs',
+            'tools/supply-chain-check.mjs',
+            'tools/supply-chain-scan.mjs',
+        ],
+        seeded: [
+            '.github/dependabot.yml',
+            'supply-chain/README.md',
+            'supply-chain/blueprint-trust-policy.json',
+            'supply-chain/blueprint-trust-snapshot.json',
+            'supply-chain/build-permissions.json',
+            'supply-chain/exceptions.json',
+            'supply-chain/license-policy.json',
+            'supply-chain/vendored-sources.json',
+            'supply-chain/vulnerability-policy.json',
+        ],
+    };
+}
+//# sourceMappingURL=generated-files.js.map

package/src/supply-chain/generated-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-files.js","sourceRoot":"","sources":["../../../../../packages/nx/src/supply-chain/generated-files.ts"],"names":[],"mappings":";;;AAgDA,8EAmDC;AAMD,kEAyBC;AAED,0EAmTC;AAvbD,sEAAyD;AAEzD,iEAAkE;AAClE,qDAG0B;AAE1B,6DAM8B;AAC9B,iGAGgD;AAChD,iEAAuE;AACvE,6FAI8C;AAC9C,qGAGkD;AAClD,iFAAiF;AACjF,2CAAiE;AACjE,6CAAyE;AAQ5D,QAAA,iCAAiC,GAAG;IAC/C,WAAW;IACX,SAAS;IACT,IAAI;IACJ,YAAY;IACZ,OAAO;IACP,eAAe;CACP,CAAC;AAEX,SAAgB,iCAAiC;IAC/C,OAAO;QACL;YACE,UAAU,EAAE,0BAA0B;YACtC,KAAK,EAAE,2CAA2C;YAClD,OAAO,EAAE,WAAW;YACpB,SAAS,EACP,uEAAuE;YACzE,QAAQ,EAAE,2CAA2C;SACtD;QACD;YACE,UAAU,EAAE,0BAA0B;YACtC,KAAK,EAAE,2CAA2C;YAClD,OAAO,EAAE,SAAS;YAClB,SAAS,EACP,kGAAkG;YACpG,QAAQ,EAAE,2CAA2C;SACtD;QACD;YACE,UAAU,EAAE,0BAA0B;YACtC,KAAK,EAAE,2CAA2C;YAClD,OAAO,EAAE,IAAI;YACb,SAAS,EACP,6EAA6E;YAC/E,QAAQ,EAAE,2CAA2C;SACtD;QACD;YACE,UAAU,EAAE,0BAA0B;YACtC,KAAK,EAAE,2CAA2C;YAClD,OAAO,EAAE,YAAY;YACrB,SAAS,EACP,kIAAkI;YACpI,QAAQ,EAAE,uCAAuC;SAClD;QACD;YACE,UAAU,EAAE,0BAA0B;YACtC,KAAK,EAAE,2CAA2C;YAClD,OAAO,EAAE,OAAO;YAChB,SAAS,EACP,iGAAiG;YACnG,QAAQ,EAAE,2CAA2C;SACtD;QACD;YACE,UAAU,EAAE,0BAA0B;YACtC,KAAK,EAAE,2CAA2C;YAClD,OAAO,EAAE,eAAe;YACxB,SAAS,EACP,yFAAyF;YAC3F,QAAQ,EAAE,2CAA2C;SACtD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC/C,CAAC;AAED,SAAgB,2BAA2B;IACzC,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,MAAM,CAAC,OAAO,CAAC,mCAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;YACrD,GAAG;YACH;gBACE,GAAG,GAAG;gBACN,KAAK,EACH,GAAG,KAAK,WAAW;oBACjB,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC;wBACI,UAAU;wBACV,kBAAkB;wBAClB,WAAW;wBACX,WAAW;wBACX,gBAAgB;qBACjB,CAAC,QAAQ,CAAC,GAAG,CAAC;wBACjB,CAAC,CAAC,MAAM;wBACR,CAAC,CAAC,UAAU;aACnB;SACF,CAAC,CACH;QACD,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,oDAAmC;KACnD,CAAC;AACJ,CAAC;AAED,SAAgB,+BAA+B,CAAC,KAE/C;IACC,MAAM,QAAQ,GAA2B,IAAA,iDAA4B,EAAC;QACpE,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,mDAA8B;QAC7C,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE;YACN,IAAI,EAAE,qBAAqB;YAC3B,SAAS,EAAE,wBAAwB;SACpC;KACF,CAAC,CAAC;IACH,MAAM,WAAW,GAAyB;QACxC,kBAAkB,EAAE,EAAE;QACtB,gBAAgB,EAAE,EAAE;QACpB,UAAU,EAAE,EAAE;QACd,aAAa,EAAE,mDAA8B;QAC7C,cAAc,EAAE,IAAA,iDAA4B,EAAC,QAAQ,CAAC;KACvD,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,wBAAwB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6C7B;QACG,2BAA2B,EAAE,IAAI,CAAC,2BAA2B,EAAE,CAAC;QAChE,0CAA0C,EAAE,IAAI,CAAC,WAAW,CAAC;QAC7D,4CAA4C,EAAE,IAAI,CAAC,QAAQ,CAAC;QAC5D,qCAAqC,EAAE,IAAI,CAAC;YAC1C,OAAO,EAAE,iCAAiC,EAAE;YAC5C,aAAa,EAAE,8CAAkC;SAClD,CAAC;QACF,8BAA8B,EAAE,IAAI,CAAC;YACnC,OAAO,EAAE,EAAE;YACX,aAAa,EAAE,8CAAkC;SAClD,CAAC;QACF,oCAAoC,EAAE,IAAI,CAAC;YACzC,OAAO,EAAE;gBACP,GAAG,MAAM,CAAC,OAAO,CAAC,iCAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpE,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,eAAe,QAAQ,EAAE;oBAC/B,MAAM,EAAE,4DAA4D,gCAAmB,IAAI,OAAO,CAAC,IAAI,EAAE;oBACzG,OAAO,EAAE,gCAAmB;iBAC7B,CAAC,CAAC;gBACH,GAAG,MAAM,CAAC,OAAO,CAAC,4DAAuB,CAAC,CAAC,GAAG,CAC5C,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,QAAQ,QAAQ,EAAE;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,iDAAY;iBACtB,CAAC,CACH;aACF,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAA,qCAAY,EAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5D,aAAa,EAAE,8CAAkC;SAClD,CAAC;QACF,kCAAkC,EAAE,IAAI,CAAC;YACvC,KAAK,EAAE;gBACL,MAAM;gBACN,YAAY;gBACZ,cAAc;gBACd,cAAc;gBACd,cAAc;gBACd,eAAe;gBACf,WAAW;gBACX,SAAS;gBACT,KAAK;gBACL,KAAK;gBACL,OAAO;gBACP,SAAS;gBACT,YAAY;gBACZ,WAAW;gBACX,OAAO;aACR;YACD,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,CAAC,oBAAoB,CAAC;YAC9B,aAAa,EAAE,8CAAkC;SAClD,CAAC;QACF,oCAAoC,EAAE,IAAI,CAAC;YACzC,OAAO,EAAE,EAAE;YACX,aAAa,EAAE,8CAAkC;SAClD,CAAC;QACF,4CAA4C,EAAE,IAAI,CAAC;YACjD,IAAI,EAAE,gCAAgC;YACtC,QAAQ,EAAE,EAAE;YACZ,gBAAgB,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,iBAAiB,CAAC;YACzD,OAAO,EAAE;gBACP,QAAQ,EAAE,EAAE;gBACZ,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/B,SAAS,EAAE,0BAA0B;gBACrC,aAAa,EAAE,CAAC;gBAChB,MAAM,EAAE,aAAa;gBACrB,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,GAAG;aACb;YACD,aAAa,EAAE,CAAC;YAChB,OAAO,EAAE;gBACP,wBAAwB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,aAAa,EAAE,EAAE;gBACjB,sBAAsB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;aACvC;YACD,eAAe,EAAE,EAAE;SACpB,CAAC;QACF,wCAAwC,EAAE,IAAI,CAAC;YAC7C,KAAK,EAAE;gBACL,QAAQ,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC;gBAC7C,IAAI,EAAE,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC;gBACzC,GAAG,EAAE,EAAE;gBACP,MAAM,EAAE,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,CAAC,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,CAAC;aAC9D;YACD,aAAa,EAAE,8CAAkC;SAClD,CAAC;QACF,iCAAiC,EAAE,IAAA,uEAAgC,GAAE;QACrE,gDAAgD,EAC9C,IAAA,8EAAuC,GAAE;QAC3C,6BAA6B,EAAE,IAAA,sEAA6B,GAAE;QAC9D,iCAAiC,EAAE,IAAA,uEAAkC,GAAE;QACvE,8BAA8B,EAAE,IAAA,oDAA6B,GAAE;QAC/D,6BAA6B,EAAE,IAAA,8DAA+B,GAAE;QAChE,wBAAwB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BA0CJ,sDAAa;;;;;;;;;;;;;;;;;;;;;;;6CAuBM,gCAAmB;;;;;;;;;;;;;;;;;;;;0DAoBN,iDAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCrE;KACW,CAAC;IACX,OAAO;QACL,KAAK;QACL,OAAO,EAAE;YACP,2BAA2B;YAC3B,oCAAoC;YACpC,4CAA4C;YAC5C,iCAAiC;YACjC,gDAAgD;YAChD,6BAA6B;YAC7B,iCAAiC;YACjC,8BAA8B;YAC9B,6BAA6B;SAC9B;QACD,MAAM,EAAE;YACN,wBAAwB;YACxB,wBAAwB;YACxB,0CAA0C;YAC1C,4CAA4C;YAC5C,qCAAqC;YACrC,8BAA8B;YAC9B,kCAAkC;YAClC,oCAAoC;YACpC,wCAAwC;SACzC;KACF,CAAC;AACJ,CAAC"}

package/src/supply-chain/generated-scanner-command.d.ts

@@ -0,0 +1 @@
+export declare function renderSupplyChainScannerCommand(): string;