@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/supply-chain/generated-ecr-collector-command.d.ts

@@ -15,7 +15,6 @@ export declare const SYFT_COLLECTOR_RELEASES: Readonly<Record<string, SyftCollec
  */
 export declare function renderEcrInspectorCollectorCommand(options?: {
     moduleSpecifier?: string;
-    releaseModuleSpecifier?: string;
     releases?: Readonly<Record<string, SyftCollectorRelease>>;
     syftVersion?: string;
 }): string;

package/src/supply-chain/generated-ecr-collector-command.js

@@ -6,6 +6,16 @@ const common_js_1 = require("./common.js");
 const safe_reference_1 = require("@empire-builder-kit/runtime/safe-reference");
 exports.SYFT_VERSION = '1.50.0';
 exports.SYFT_COLLECTOR_RELEASES = Object.freeze({
+    'darwin-arm64': {
+        archiveFormat: 'tar-gzip',
+        sha256: 'e32fdb9d47823fa633748a1efca2528fd77c37469ea93c9e40ab835da44e4cce',
+        source: 'https://github.com/anchore/syft/releases/download/v1.50.0/syft_1.50.0_darwin_arm64.tar.gz',
+    },
+    'darwin-x64': {
+        archiveFormat: 'tar-gzip',
+        sha256: 'd11a8c7bc27114853bd7c1e1b2f3be3ddda3a1de17aee585329f04c369341c75',
+        source: 'https://github.com/anchore/syft/releases/download/v1.50.0/syft_1.50.0_darwin_amd64.tar.gz',
+    },
     'linux-arm64': {
         archiveFormat: 'tar-gzip',
         sha256: '887c57cbcc2d0e8c5c110a4571a3fc7150058b24d74f993ee4663516e5c8ce86',
@@ -37,11 +47,9 @@ function validatedReleases(releases) {
  */
 function renderEcrInspectorCollectorCommand(options = {}) {
     const moduleSpecifier = options.moduleSpecifier ?? '@empire-builder-kit/nx/supply-chain';
-    const releaseModuleSpecifier = options.releaseModuleSpecifier ?? '@empire-builder-kit/nx/release';
     const releases = validatedReleases(options.releases ?? exports.SYFT_COLLECTOR_RELEASES);
     const syftVersion = options.syftVersion ?? exports.SYFT_VERSION;
     if (!/^(?:@empire-builder-kit\/nx\/supply-chain|file:\/\/\/[^'"\n]+)$/.test(moduleSpecifier) ||
-        !/^(?:@empire-builder-kit\/nx\/release|file:\/\/\/[^'"\n]+)$/.test(releaseModuleSpecifier) ||
         !/^\d+\.\d+\.\d+$/.test(syftVersion)) {
         throw new Error('The generated ECR collector configuration is invalid.');
     }
@@ -70,7 +78,6 @@ import {
   verifyEcrInspectorScanEvidence,
   verifyEcsDeployedImageBinding,
 } from '${moduleSpecifier}';
-import { validateReleaseManifest } from '${releaseModuleSpecifier}';
 
 const SYFT_VERSION = ${JSON.stringify(syftVersion)};
 const SYFT_RELEASES = Object.freeze(${JSON.stringify(releases)});
@@ -272,15 +279,21 @@ if (
         'accountId',
         'artifactId',
         'deployment',
+        'deployRunAttempt',
+        'deployRunId',
+        'deploymentReceiptPath',
         'outputDirectory',
+        'postdeployBindingPath',
         'region',
-        'releaseManifestPath',
+        'releaseCandidatePath',
         'schemaVersion',
         'stage',
         'taskDefinitionFamily',
       ].includes(key),
   ) ||
   !/^\\d{12}$/.test(input.accountId ?? '') ||
+  !/^[1-9]\\d*$/.test(input.deployRunAttempt ?? '') ||
+  !/^[1-9]\\d*$/.test(input.deployRunId ?? '') ||
   !/^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\\d$/.test(input.region ?? '') ||
   !['production', 'staging'].includes(input.stage) ||
   typeof input.artifactId !== 'string' ||
@@ -331,9 +344,17 @@ if (
     'ECR collector deployment must identify one exact ECS service or task.',
   );
 }
-const manifestPath = safePath(
-  input.releaseManifestPath,
-  'releaseManifestPath',
+const candidatePath = safePath(
+  input.releaseCandidatePath,
+  'releaseCandidatePath',
+);
+const deploymentReceiptPath = safePath(
+  input.deploymentReceiptPath,
+  'deploymentReceiptPath',
+);
+const postdeployBindingPath = safePath(
+  input.postdeployBindingPath,
+  'postdeployBindingPath',
 );
 const outputDirectory = safePath(
   input.outputDirectory ??
@@ -341,43 +362,125 @@ const outputDirectory = safePath(
   'outputDirectory',
   { directory: true, output: true },
 );
-const manifestBytes = readBoundedFile(
-  manifestPath,
+const candidateBytes = readBoundedFile(
+  candidatePath,
   MAX_INPUT_BYTES,
-  'Release manifest exceeds its bounded input size.',
+  'Release candidate exceeds its bounded input size.',
 );
-const parsedManifest = requireRecord(
-  JSON.parse(manifestBytes.toString('utf8')),
-  'Release manifest must be an object.',
+const candidate = requireRecord(
+  JSON.parse(candidateBytes.toString('utf8')),
+  'Release candidate must be an object.',
 );
-const manifest = validateReleaseManifest(parsedManifest, {
-  materialDigest: parsedManifest.materialDigest,
-  sourceCommit: parsedManifest.source?.commit,
-});
+const deploymentReceipt = requireRecord(
+  readJson(deploymentReceiptPath, 'Deployment receipt is invalid.'),
+  'Deployment receipt must be an object.',
+);
+const postdeployBinding = requireRecord(
+  readJson(postdeployBindingPath, 'Postdeploy binding is invalid.'),
+  'Postdeploy binding must be an object.',
+);
+const postdeployBindingKeys = [
+  'accountId',
+  'deploymentCommit',
+  'kind',
+  'materialDigest',
+  'profile',
+  'region',
+  'releaseCandidateArtifactDigest',
+  'releaseCandidateArtifactId',
+  'releaseCandidateProducerRunAttempt',
+  'releaseCandidateProducerRunId',
+  'releaseSourceCommit',
+  'runAttempt',
+  'runId',
+  'schemaVersion',
+  'stage',
+].sort();
 const sliceRoot = realpathSync(process.cwd());
 const slice = basename(sliceRoot);
 if (
-  manifest.kind !== 'ebk-release-manifest' ||
-  manifest.schemaVersion !== 1 ||
-  typeof manifest.releaseId !== 'string' ||
-  !REFERENCE.test(manifest.releaseId) ||
-  typeof manifest.materialDigest !== 'string' ||
-  !SHA256.test(manifest.materialDigest) ||
-  !manifest.source ||
-  !COMMIT.test(manifest.source.commit ?? '') ||
-  !Array.isArray(manifest.projects) ||
-  !manifest.projects.includes(slice) ||
   relative(repositoryRoot, sliceRoot).split(sep).join('/') !==
-    'packages/' + slice
+    'packages/' + slice ||
+  candidate.kind !== 'ebk-release-candidate' ||
+  candidate.schemaVersion !== 1 ||
+  candidate.slice !== slice ||
+  !COMMIT.test(candidate.sourceCommit ?? '') ||
+  !SHA256.test(candidate.artifactEvidenceDigest ?? '') ||
+  !SHA256.test(candidate.inventoryDigest ?? '') ||
+  !candidate.provenance ||
+  candidate.provenance.kind !== 'ebk-release-candidate-provenance' ||
+  candidate.provenance.schemaVersion !== 1 ||
+  candidate.provenance.sourceCommit !== candidate.sourceCommit ||
+  !/^[1-9]\\d*$/.test(candidate.provenance.runAttempt ?? '') ||
+  !/^[1-9]\\d*$/.test(candidate.provenance.runId ?? '') ||
+  typeof candidate.provenance.workflow !== 'string' ||
+  candidate.provenance.workflow.length === 0 ||
+  deploymentReceipt.kind !== 'ebk-deployment-receipt' ||
+  deploymentReceipt.schemaVersion !== 1 ||
+  deploymentReceipt.outcome !== 'succeeded' ||
+  deploymentReceipt.authority !== 'github' ||
+  deploymentReceipt.account !== input.accountId ||
+  deploymentReceipt.region !== input.region ||
+  deploymentReceipt.stage !== input.stage ||
+  !['starter', 'production-isolated', 'fully-isolated'].includes(
+    deploymentReceipt.profile,
+  ) ||
+  deploymentReceipt.source?.clean !== true ||
+  !COMMIT.test(deploymentReceipt.source?.commit ?? '') ||
+  !Array.isArray(deploymentReceipt.children) ||
+  deploymentReceipt.children.length === 0 ||
+  deploymentReceipt.children.some((child) => child?.outcome !== 'succeeded') ||
+  postdeployBinding.kind !== 'ebk-postdeploy-supply-chain-binding' ||
+  postdeployBinding.schemaVersion !== 1 ||
+  postdeployBinding.accountId !== input.accountId ||
+  postdeployBinding.region !== input.region ||
+  postdeployBinding.stage !== input.stage ||
+  postdeployBinding.profile !== deploymentReceipt.profile ||
+  postdeployBinding.deploymentCommit !== deploymentReceipt.source.commit ||
+  postdeployBinding.releaseSourceCommit !== candidate.sourceCommit ||
+  postdeployBinding.releaseCandidateProducerRunAttempt !==
+    candidate.provenance.runAttempt ||
+  postdeployBinding.releaseCandidateProducerRunId !==
+    candidate.provenance.runId ||
+  JSON.stringify(Object.keys(postdeployBinding).sort()) !==
+    JSON.stringify(postdeployBindingKeys) ||
+  !/^sha256:[a-f0-9]{64}$/.test(
+    postdeployBinding.releaseCandidateArtifactDigest ?? '',
+  ) ||
+  !/^[1-9]\\d*$/.test(postdeployBinding.releaseCandidateArtifactId ?? '') ||
+  !/^[1-9]\\d*$/.test(
+    postdeployBinding.releaseCandidateProducerRunAttempt ?? '',
+  ) ||
+  !/^[1-9]\\d*$/.test(
+    postdeployBinding.releaseCandidateProducerRunId ?? '',
+  ) ||
+  !/^[1-9]\\d*$/.test(postdeployBinding.runAttempt ?? '') ||
+  !/^[1-9]\\d*$/.test(postdeployBinding.runId ?? '') ||
+  postdeployBinding.runAttempt !== input.deployRunAttempt ||
+  postdeployBinding.runId !== input.deployRunId ||
+  postdeployBinding.materialDigest !==
+    digestValue(
+      Object.fromEntries(
+        Object.entries(postdeployBinding).filter(
+          ([key]) => key !== 'materialDigest',
+        ),
+      ),
+    )
 ) {
-  throw new Error('Release manifest is invalid for the current Slice.');
+  throw new Error(
+    'Release candidate, deployment receipt, and postdeploy binding are not exact.',
+  );
 }
 if (
-  relative(sliceRoot, manifestPath).split(sep).join('/') !==
-    '.ebk/evidence/release-manifests/' + manifest.releaseId + '.json'
+  relative(repositoryRoot, candidatePath).split(sep).join('/') !==
+    '.ebk/evidence/ecr-original-release-candidate/packages/' + slice + '/candidate.json' ||
+  relative(repositoryRoot, deploymentReceiptPath).split(sep).join('/') !==
+    '.ebk/evidence/deployment/latest.json' ||
+  relative(repositoryRoot, postdeployBindingPath).split(sep).join('/') !==
+    '.ebk/evidence/deployment/postdeploy-supply-chain.json'
 ) {
   throw new Error(
-    'Release manifest must use its canonical immutable evidence path.',
+    'Postdeploy evidence must use its canonical immutable paths.',
   );
 }
 const controlsPath = realpathSync(
@@ -388,35 +491,34 @@ const releaseControls = requireRecord(
   'Release controls must be an object.',
 );
 const artifactEvidencePath = realpathSync(
-  join(
-    sliceRoot,
-    '.ebk/evidence/release-artifacts',
-    manifest.source.commit + '.json',
-  ),
+  join(dirname(candidatePath), 'release-artifacts.json'),
+);
+const artifactEvidenceBytes = readBoundedFile(
+  artifactEvidencePath,
+  MAX_INPUT_BYTES,
+  'Release artifact evidence exceeds its bounded input size.',
 );
 const artifacts = requireRecord(
-  readJson(
-    artifactEvidencePath,
-    'Release artifact evidence is invalid.',
-  ),
+  JSON.parse(artifactEvidenceBytes.toString('utf8')),
   'Release artifact evidence must be an object.',
 );
 if (
+  candidate.artifactEvidenceDigest !== digestBytes(artifactEvidenceBytes) ||
   artifacts.kind !== 'ebk-release-artifact-evidence' ||
   artifacts.schemaVersion !== 1 ||
-  artifacts.sourceCommit !== manifest.source.commit ||
+  artifacts.sourceCommit !== candidate.sourceCommit ||
   !artifacts.provenance ||
   !/^[1-9]\\d*$/.test(artifacts.provenance.runAttempt ?? '') ||
   !/^[1-9]\\d*$/.test(artifacts.provenance.runId ?? '') ||
   typeof artifacts.provenance.workflow !== 'string' ||
-  artifacts.provenance.runId !== manifest.build?.runId ||
-  artifacts.provenance.workflow !== manifest.build?.workflow ||
+  artifacts.provenance.runId !== candidate.provenance.runId ||
+  artifacts.provenance.runAttempt !== candidate.provenance.runAttempt ||
+  artifacts.provenance.workflow !== candidate.provenance.workflow ||
   !Array.isArray(artifacts.artifacts) ||
-  !Array.isArray(manifest.artifacts) ||
   !Array.isArray(releaseControls.artifactInventory)
 ) {
   throw new Error(
-    'Release manifest and candidate artifact evidence are not exactly bound.',
+    'Release candidate and artifact evidence are not exactly bound.',
   );
 }
 const inventoryDigest = digestBytes(
@@ -425,48 +527,34 @@ const inventoryDigest = digestBytes(
 const capturedByName = new Map(
   artifacts.artifacts.map((artifact) => [artifact?.name, artifact]),
 );
-const manifestByName = new Map(
-  manifest.artifacts.map((artifact) => [artifact?.name, artifact]),
-);
 if (
+  candidate.inventoryDigest !== inventoryDigest ||
   artifacts.inventoryDigest !== inventoryDigest ||
   artifacts.artifacts.length !== releaseControls.artifactInventory.length ||
-  manifest.artifacts.length !== releaseControls.artifactInventory.length ||
   capturedByName.size !== artifacts.artifacts.length ||
-  manifestByName.size !== manifest.artifacts.length ||
   releaseControls.artifactInventory.some((registered) => {
     const captured = capturedByName.get(registered.name);
-    const retained = manifestByName.get(registered.name);
     const capturedDigest =
       captured?.classification === 'stage-neutral'
         ? captured.digest
         : captured?.candidateDigest;
-    const retainedDigest =
-      retained?.classification === 'stage-neutral'
-        ? retained.digest
-        : retained?.candidateDigest;
     return (
       !captured ||
-      !retained ||
       captured.name !== registered.name ||
       captured.workload !== registered.workload ||
       captured.classification !== registered.classification ||
-      retained.workload !== registered.workload ||
-      retained.classification !== registered.classification ||
-      capturedDigest !== retainedDigest ||
       !SHA256.test(capturedDigest ?? '') ||
       (registered.classification === 'stage-specific' &&
         (captured.reason !== registered.reason ||
-          captured.providerEvidence !== registered.providerEvidence ||
-          retained.reason !== registered.reason ||
-          retained.providerEvidence !== registered.providerEvidence))
+          captured.providerEvidence !== registered.providerEvidence))
     );
   })
 ) {
   throw new Error(
-    'Release controls, candidate evidence, and manifest artifacts do not reconcile exactly.',
+    'Release controls and candidate evidence do not reconcile exactly.',
   );
 }
+const releaseCandidateDigest = digestBytes(candidateBytes);
 const applicability = assessEcrScanApplicability(
   releaseControls,
   slice,
@@ -504,13 +592,13 @@ if (
     'OCI artifacts must use the exact <slice>.<kind>.<workload> identity.',
   );
 }
-const candidate = capturedByName.get(declared.name);
+const capturedArtifact = capturedByName.get(declared.name);
 const candidateArtifactDigest =
-  candidate?.classification === 'stage-neutral'
-    ? candidate.digest
-    : candidate?.candidateDigest;
+  capturedArtifact?.classification === 'stage-neutral'
+    ? capturedArtifact.digest
+    : capturedArtifact?.candidateDigest;
 if (
-  !candidate ||
+  !capturedArtifact ||
   !SHA256.test(candidateArtifactDigest ?? '') ||
   artifacts.artifacts.filter(({ name }) => name === declared.name).length !== 1
 ) {
@@ -547,7 +635,7 @@ const containerBinding = validateContainerReleaseBinding(
     candidateDigests: containerCandidateDigests,
     region: input.region,
     slice,
-    sourceCommit: manifest.source.commit,
+    sourceCommit: candidate.sourceCommit,
     stage: input.stage,
   },
 );
@@ -555,7 +643,6 @@ const containerArtifact = resolveContainerReleaseArtifact(containerBinding, {
   artifactId: input.artifactId,
   candidateArtifactDigest,
 });
-const releaseManifestDigest = digestBytes(manifestBytes);
 const expected = {
   accountId: input.accountId,
   artifactId: input.artifactId,
@@ -564,11 +651,16 @@ const expected = {
   containerImageDigest: containerArtifact.imageDigest,
   imageReference: containerArtifact.imageReference,
   region: input.region,
-  releaseId: manifest.releaseId,
-  releaseManifestDigest,
-  releaseManifestMaterialDigest: manifest.materialDigest,
+  releaseCandidateArtifactDigest:
+    postdeployBinding.releaseCandidateArtifactDigest,
+  releaseCandidateArtifactId: postdeployBinding.releaseCandidateArtifactId,
+  releaseCandidateDigest,
+  releaseCandidateProducerRunAttempt:
+    postdeployBinding.releaseCandidateProducerRunAttempt,
+  releaseCandidateProducerRunId:
+    postdeployBinding.releaseCandidateProducerRunId,
   repositoryName: containerArtifact.repositoryName,
-  sourceCommit: manifest.source.commit,
+  sourceCommit: candidate.sourceCommit,
   stage: input.stage,
   taskDefinitionFamily: input.taskDefinitionFamily,
   deployment: input.deployment,
@@ -934,7 +1026,7 @@ try {
       }
       if (
         sbom?.bomFormat !== 'CycloneDX' ||
-        sbom.specVersion !== '1.6' ||
+        sbom.specVersion !== '1.7' ||
         sbom.version !== 1 ||
         typeof sbom.serialNumber !== 'string' ||
         !/^urn:uuid:[a-fA-F0-9-]{36}$/.test(sbom.serialNumber) ||
@@ -945,7 +1037,7 @@ try {
         typeof sbom.metadata !== 'object'
       ) {
         throw new Error(
-          'Syft output is not complete CycloneDX 1.6 evidence for ' +
+          'Syft output is not complete CycloneDX 1.7 evidence for ' +
             platform.platform + '.',
         );
       }
@@ -1082,7 +1174,8 @@ try {
   }
 
   const prefix =
-    manifest.releaseId + '-' + declared.name.replaceAll('/', '-');
+    'release-candidate-' + releaseCandidateDigest.slice(0, 32) + '-' +
+    declared.name.replaceAll('/', '-');
   const sbom = createCycloneDxPlatformSbomUnion({
     artifact: {
       'bom-ref': deploymentBinding.imageReference,
@@ -1140,9 +1233,15 @@ try {
       { name: 'ebk:image:digest', value: imageDigest },
       { name: 'ebk:image:reference', value: deploymentBinding.imageReference },
       { name: 'ebk:inventory:scope', value: 'final-oci-contents' },
-      { name: 'ebk:release:id', value: manifest.releaseId },
-      { name: 'ebk:release:manifest-digest', value: releaseManifestDigest },
-      { name: 'ebk:source:commit', value: manifest.source.commit },
+      {
+        name: 'ebk:release-candidate:artifact-digest',
+        value: postdeployBinding.releaseCandidateArtifactDigest,
+      },
+      {
+        name: 'ebk:release-candidate:sha256',
+        value: releaseCandidateDigest,
+      },
+      { name: 'ebk:source:commit', value: candidate.sourceCommit },
     ],
   });
   const serializedSbom = JSON.stringify(sbom, null, 2) + '\\n';
@@ -1156,8 +1255,8 @@ try {
       accountId: input.accountId,
       artifactId: declared.name,
       region: input.region,
-      releaseId: manifest.releaseId,
-      sourceCommit: manifest.source.commit,
+      releaseCandidateDigest,
+      sourceCommit: candidate.sourceCommit,
       stage: input.stage,
     },
   };
@@ -1172,12 +1271,17 @@ try {
     collectorTranscriptDigest: transcript.materialDigest,
     deploymentBindingDigest: deploymentBinding.materialDigest,
     region: input.region,
-    releaseId: manifest.releaseId,
-    releaseManifestDigest,
-    releaseManifestMaterialDigest: manifest.materialDigest,
+    releaseCandidateArtifactDigest:
+      postdeployBinding.releaseCandidateArtifactDigest,
+    releaseCandidateArtifactId: postdeployBinding.releaseCandidateArtifactId,
+    releaseCandidateDigest,
+    releaseCandidateProducerRunAttempt:
+      postdeployBinding.releaseCandidateProducerRunAttempt,
+    releaseCandidateProducerRunId:
+      postdeployBinding.releaseCandidateProducerRunId,
     repositoryName,
     sbomInventoryScope: 'final-oci-contents',
-    sourceCommit: manifest.source.commit,
+    sourceCommit: candidate.sourceCommit,
     stage: input.stage,
   };
   const target = {
@@ -1275,11 +1379,14 @@ try {
       })),
     ),
     kind: 'ebk-production-release-component-impact',
-    release: {
-      id: manifest.releaseId,
-      manifestDigest: releaseManifestDigest,
-      manifestMaterialDigest: manifest.materialDigest,
-      sourceCommit: manifest.source.commit,
+    releaseCandidate: {
+      artifactDigest: postdeployBinding.releaseCandidateArtifactDigest,
+      artifactId: postdeployBinding.releaseCandidateArtifactId,
+      digest: releaseCandidateDigest,
+      producerRunAttempt:
+        postdeployBinding.releaseCandidateProducerRunAttempt,
+      producerRunId: postdeployBinding.releaseCandidateProducerRunId,
+      sourceCommit: candidate.sourceCommit,
       stage: input.stage,
     },
     sbom: {
@@ -1324,7 +1431,7 @@ try {
     deploymentBindingDigest: deploymentBinding.materialDigest,
     imageDigest,
     impactDigest: impact.materialDigest,
-    releaseId: manifest.releaseId,
+    releaseCandidateDigest,
     platformScanEvidenceDigests: scanEvidence.platformScans,
     scanEvidenceDigest: scanEvidence.materialDigest,
     sbomDigest,

package/src/supply-chain/generated-files.js

@@ -78,17 +78,16 @@ function frameworkActionPinInventory() {
             key,
             {
                 ...pin,
-                scope: key === 'nxSetShas'
-                    ? 'framework'
-                    : [
-                        'checkout',
-                        'downloadArtifact',
-                        'pnpmSetup',
-                        'setupNode',
-                        'uploadArtifact',
-                    ].includes(key)
-                        ? 'both'
-                        : 'consumer',
+                scope: [
+                    'checkout',
+                    'downloadArtifact',
+                    'nxSetShas',
+                    'pnpmSetup',
+                    'setupNode',
+                    'uploadArtifact',
+                ].includes(key)
+                    ? 'both'
+                    : 'consumer',
             },
         ])),
         containers: {},
@@ -265,6 +264,17 @@ permissions, advisories, alternatives, removal path, and owning team in the
 pull request. Changes to \`allowBuilds\` require a matching exact-package record
 with owner, rationale, work item, and approval time.
 
+Pin reviewed transitive fixes in the seeded
+\`supply-chain/dependency-overrides.json\` file, using
+\`{"schemaVersion":1,"overrides":{"package@range":"1.2.3"}}\`.
+Parent selectors such as \`parent>dependency\` are supported. Values must be
+exact npm versions; alternate registries, local paths, hooks, and ranges are
+not admitted by this surface. Report and apply \`nx g @empire-builder-kit/nx:upgrade workspace\`
+to generate the effective managed \`pnpm-workspace.yaml\`, then run
+\`pnpm install\` to reconcile its lockfile and installed dependency state.
+Review the lockfile and rerun affected checks. Never edit the managed YAML or
+ownership hashes. Pins do not waive the existing supply-chain policies.
+
 The license lists are organization-owned policy, not legal conclusions.
 Unknown and changed licenses require review. Exceptions are exact-component,
 approved, expiring records with compensating controls and recheck triggers.
@@ -307,9 +317,10 @@ accounts must differ.
 
 The v1 executable-action inventory admits only reviewed external actions
 pinned to full Git commit SHAs and Docker actions pinned to immutable image
-digests. Repository-local \`uses: ./...\` actions are rejected instead of
-silently trusted. If local composite actions are added after v1, their nested
-execution graph needs an explicit bounded recursive review contract first.
+digests. Static job-level \`uses: ./.github/workflows/*.yml\` calls are admitted
+only when the exact repository target exists and declares \`workflow_call\`.
+Repository-local step actions remain rejected instead of silently trusting a
+local composite execution graph.
 
 Default workspace verification runs the explicit
 \`structural-scanner-input.json\` sentinel. Its output records that no scanner

package/src/supply-chain/generated-scanner-command.js

@@ -271,6 +271,7 @@ const ignoredDirectories = new Set([
   '.nx',
   '.open-next',
   '.sst',
+  '.venv',
   'coverage',
   'dist',
   'node_modules',
@@ -427,7 +428,7 @@ async function resolveOsvBinary() {
   }
   const target = options.osv
     ? insideWorkspace(options.osv)
-    : insideWorkspace('.ebk/tools/' + release.name);
+    : insideWorkspace('.ebk/cache/tools/' + release.name);
   if (!options.osv && !existsSync(target)) {
     const response = await fetch(
       'https://github.com/google/osv-scanner/releases/download/v' +

package/src/supply-chain/index.d.ts

@@ -6,7 +6,7 @@ export * from './blueprint-verification-execution.js';
 export * from './pnpm-toolchain-authority.js';
 export * from './container-artifact-contract.js';
 export * from './container-release.js';
-export { supplyChainDigest } from './common.js';
+export { hasSensitiveSupplyChainShape, supplyChainDigest } from './common.js';
 export * from './ecs-deployed-image.js';
 export * from './errors.js';
 export * from './build-output.js';

package/src/supply-chain/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.frameworkActionPinInventory = exports.supplyChainDigest = void 0;
+exports.frameworkActionPinInventory = exports.supplyChainDigest = exports.hasSensitiveSupplyChainShape = void 0;
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./action-pins.js"), exports);
 tslib_1.__exportStar(require("./blueprint-trust.js"), exports);
@@ -11,6 +11,7 @@ tslib_1.__exportStar(require("./pnpm-toolchain-authority.js"), exports);
 tslib_1.__exportStar(require("./container-artifact-contract.js"), exports);
 tslib_1.__exportStar(require("./container-release.js"), exports);
 var common_js_1 = require("./common.js");
+Object.defineProperty(exports, "hasSensitiveSupplyChainShape", { enumerable: true, get: function () { return common_js_1.hasSensitiveSupplyChainShape; } });
 Object.defineProperty(exports, "supplyChainDigest", { enumerable: true, get: function () { return common_js_1.supplyChainDigest; } });
 tslib_1.__exportStar(require("./ecs-deployed-image.js"), exports);
 tslib_1.__exportStar(require("./errors.js"), exports);

package/src/supply-chain/sbom.d.ts

@@ -1,5 +1,5 @@
 import type { SupplyChainInventory } from './inventory.js';
-export declare const CYCLONEDX_SPEC_VERSION: "1.6";
+export declare const CYCLONEDX_SPEC_VERSION: "1.7";
 export declare const SUPPLY_CHAIN_SBOM_SCHEMA_VERSION: 1;
 export declare const SUPPLY_CHAIN_RELEASE_BINDING_KIND: "ebk-supply-chain-release-binding";
 export declare const CYCLONEDX_INVENTORY_SCOPES: readonly ["source-build-inputs", "build-output-contents", "deployable-bundle-contents", "final-oci-contents"];