@getarbiter/cli 0.5.0

package/dist/templates/github/workflows/05-release.yml.ejs

@@ -0,0 +1,813 @@
+<%
+// #1723: bucket flags come from withServiceBucket (src/utils/render.ts); do not duplicate the map.
+const _bucket = serviceBucket;
+const _isService = isService;
+const _isCli = isCli;
+const _isBatch = isBatch;
+// #1720: isL3Plus includes L4; a literal L3 comparison downgraded its provenance.
+const _slsaL3 = isL3Plus;
+const _verifyOnSign = governanceLevel !== 'L1';
+// #2138: sign and publish the same npm tarball; rebuilding would invalidate artifact provenance.
+const _npmLib = language === 'typescript' && !_isService && !_isCli && !_isBatch;
+const _artifact = _npmLib ? 'release-artifact.tgz' : 'release-artifact.zip';
+%>name: Release (T3)
+
+# E3: productive jobs run only on tag pushes; PR builds previously leaked through unguarded roots.
+# Manual npm authentication is separate and cannot reach the productive chain.
+on:
+<% if (_npmLib) { %>
+  workflow_dispatch:
+<% } -%>
+  push:
+    tags:
+      - 'v*'
+      - '!v0.0.0-verify-*'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+<% if (_npmLib) { %>
+  npm-auth-smoke:
+    name: Read-only npm authentication smoke
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          package-manager-cache: false
+      - name: Check identity and scope visibility (publication remains unproven)
+        id: npm-auth
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: |
+          node --input-type=module <<'NODE'
+          const token = process.env.NPM_TOKEN;
+          if (!token) { console.error('NPM_TOKEN is missing'); process.exit(1); }
+          const request = path => fetch('https://registry.npmjs.org' + path, {
+            headers: { authorization: 'Bearer ' + token },
+            redirect: 'error', signal: AbortSignal.timeout(15000)
+          });
+          try {
+            const identity = await request('/-/whoami');
+            if (!identity.ok) throw new Error('Authentication rejected');
+            const { username } = await identity.json();
+            if (typeof username !== 'string' || !username.trim() || username === token) throw new Error('Invalid identity');
+            let scopeHttp = null, ownRole = 'UNPROVEN';
+            try {
+              const scope = await request('/-/org/arbiter/user');
+              scopeHttp = scope.status;
+              if (scope.ok) {
+                const members = await scope.json();
+                const role = members?.[username];
+                if (['owner', 'admin', 'developer'].includes(role)) ownRole = role;
+              }
+            } catch { /* Identity is proven; unavailable scope access is not. */ }
+            console.log(JSON.stringify({ authentication: 'PASS', username, scopeHttp, ownRole, publicationAuthorization: 'NOT_PROVEN' }));
+          } catch {
+            console.error('npm authentication failed (missing, rejected, malformed or unavailable identity)');
+            process.exit(1);
+          }
+          NODE
+
+<% } %>
+  build-superset:
+    name: Build superset
+<% if (_npmLib) { %>
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+<% } %>
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_BUILD || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+<% if (_npmLib) { %>
+      - name: Verify release tag matches package version
+        id: release-version
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          VERSION=$(node -e "const v=require('./package.json').version; if(typeof v!=='string'||!v) process.exit(1); process.stdout.write(v)")
+          test "$RELEASE_TAG" = "v$VERSION" || { echo "::error::Release tag does not match package.json"; exit 1; }
+<% } %>
+      - run: npm run build
+<% if (_npmLib) { %>
+      - name: Package artifact (#2138 — pack ONCE, this exact tarball is signed and published)
+        # #2138: all signatures and attestations follow this tarball through publication.
+        run: |
+          TARBALL=$(npm pack --silent --pack-destination .)
+          mv "$TARBALL" <%= _artifact %>
+<% } else { %>
+      - name: Package artifact
+        run: zip -r <%= _artifact %> dist/
+<% } %>
+<%# #1803/#1724: Gradle/Maven compile Kotlin in the Java reactor; SBOM needs that artifact. -%>
+<% } else if (language === 'java' || language === 'kotlin') { %>
+      - uses: ./.github/actions/setup-java-maven
+<% if (buildTool === 'gradle') { %>
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a  # v4
+      - run: ./gradlew build -x test
+      - name: Package artifact
+        run: zip -r <%= _artifact %> build/libs/
+<% } else { %>
+      - run: mvn -B package -DskipTests
+      - name: Package artifact
+        run: zip -r <%= _artifact %> target/
+<% } %>
+<% } else if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: go.mod
+      - run: go build -o dist/app ./...
+      - name: Package artifact
+        run: zip -r <%= _artifact %> dist/
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version-file: .python-version
+      - run: pip install build
+      - run: python -m build
+      - name: Package artifact
+        run: zip -r <%= _artifact %> dist/
+<% } else if (language === 'rust') { %>
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+      - run: cargo build --release
+      - name: Package artifact
+        run: zip -r <%= _artifact %> target/release/
+<% } %>
+      - name: Compute artifact hash
+        id: hash
+        run: |
+          sha256sum <%= _artifact %> > sha256sums.txt
+          echo "hashes=$(base64 -w0 sha256sums.txt)" >> "$GITHUB_OUTPUT"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: release-artifact
+          path: |
+            <%= _artifact %>
+            sha256sums.txt
+          retention-days: 30
+
+  trivy-fs-scan:
+    name: Trivy filesystem scan (CRITICAL block, INV-92)
+    needs: [build-superset]
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Scan filesystem for CRITICAL vulnerabilities
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: table
+          exit-code: '1'
+          severity: CRITICAL
+          trivyignores: .trivyignore
+
+  mutation-blocking:
+    name: Mutation tests (consume nightly, fallback run)
+    needs: [build-superset]
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    # #1505: mutation and fail-on-empty block at every emitted level, including L1.
+    continue-on-error: false
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      # #1502: consume fresh nightly mutation evidence to avoid a synchronous rerun.
+      # Missing/stale evidence requires a blocking, nonempty fallback (#1505).
+      - name: Consume latest nightly mutation-deep result
+        id: nightly
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          # Freshness window (days) for accepting a nightly mutation result; repo/org var override.
+          MUTATION_NIGHTLY_MAX_AGE_DAYS: ${{ vars.MUTATION_NIGHTLY_MAX_AGE_DAYS || '7' }}
+        run: |
+          set -uo pipefail
+          FRESH=false
+          MAX_AGE="${MUTATION_NIGHTLY_MAX_AGE_DAYS:-7}"
+          RUN_JSON=$(gh run list --repo "$GH_REPO" --workflow 06-nightly.yml \
+            --branch "$DEFAULT_BRANCH" --status completed --limit 1 \
+            --json databaseId,createdAt 2>/dev/null || echo '[]')
+          RUN_ID=$(printf '%s' "$RUN_JSON" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d[0]['databaseId'] if d else '')" 2>/dev/null || echo '')
+          if [ -n "$RUN_ID" ]; then
+            CREATED=$(printf '%s' "$RUN_JSON" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d[0]['createdAt'] if d else '')" 2>/dev/null || echo '')
+            CONCLUSION=$(gh api "repos/$GH_REPO/actions/runs/$RUN_ID/jobs" \
+              --jq '.jobs[] | select(.name=="Deep mutation testing") | .conclusion' 2>/dev/null || echo '')
+            AGE_DAYS=99999
+            if [ -n "$CREATED" ]; then
+              AGE_DAYS=$(( ( $(date -u +%s) - $(date -u -d "$CREATED" +%s) ) / 86400 ))
+            fi
+            echo "Latest nightly run $RUN_ID: mutation-deep=${CONCLUSION:-unknown}, age=${AGE_DAYS}d (max ${MAX_AGE}d)"
+            if [ "$CONCLUSION" = "success" ] && [ "$AGE_DAYS" -le "$MAX_AGE" ]; then
+              FRESH=true
+              echo "::notice::Release mutation gate satisfied by nightly mutation-deep (run $RUN_ID)."
+            fi
+          else
+            echo "No completed nightly run found on $DEFAULT_BRANCH."
+          fi
+          echo "fresh=$FRESH" >> "$GITHUB_OUTPUT"
+          [ "$FRESH" = "true" ] || echo "No fresh nightly mutation result — running mutation synchronously as fallback."
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+        if: steps.nightly.outputs.fresh != 'true'
+      - name: Stryker mutation (fallback — no fresh nightly)
+        if: steps.nightly.outputs.fresh != 'true'
+        # errexit + pipefail (GitHub bash default) make a below-threshold mutation score fail the
+        # step; the tee feeds the fail-on-empty guard below (#1505).
+        run: npx stryker run 2>&1 | tee mutation-fallback.log
+<% } else if (language === 'java') { %>
+      - uses: ./.github/actions/setup-java-maven
+        if: steps.nightly.outputs.fresh != 'true'
+<% if (buildTool === 'gradle') { %>
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a  # v4
+        if: steps.nightly.outputs.fresh != 'true'
+      - name: PITest mutation (fallback — no fresh nightly)
+        if: steps.nightly.outputs.fresh != 'true'
+        run: ./gradlew pitest 2>&1 | tee mutation-fallback.log
+<% } else { %>
+      - name: PITest mutation (fallback — no fresh nightly)
+        if: steps.nightly.outputs.fresh != 'true'
+        run: mvn pitest:mutationCoverage 2>&1 | tee mutation-fallback.log
+<% } %>
+<% } else if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        if: steps.nightly.outputs.fresh != 'true'
+        with:
+          go-version-file: go.mod
+      # #1505: never swallow Go mutation failures; the next guard also rejects empty runs.
+      - name: go-mutesting (fallback — no fresh nightly)
+        if: steps.nightly.outputs.fresh != 'true'
+        run: |
+          go install github.com/zimmski/go-mutesting/cmd/go-mutesting@latest
+          go-mutesting ./... 2>&1 | tee mutation-fallback.log
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        if: steps.nightly.outputs.fresh != 'true'
+        with:
+          python-version-file: .python-version
+      - run: pip install -e ".[dev]" mutmut
+        if: steps.nightly.outputs.fresh != 'true'
+      - name: mutmut mutation (fallback — no fresh nightly)
+        if: steps.nightly.outputs.fresh != 'true'
+        run: |
+          mutmut run 2>&1 | tee mutation-fallback.log
+          mutmut results 2>&1 | tee -a mutation-fallback.log
+<% } else if (language === 'rust') { %>
+      - name: Install Rust toolchain
+        if: steps.nightly.outputs.fresh != 'true'
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+      - name: cargo-mutants mutation (fallback — no fresh nightly)
+        if: steps.nightly.outputs.fresh != 'true'
+        run: |
+          cargo install cargo-mutants --locked
+          cargo mutants --all-features 2>&1 | tee mutation-fallback.log
+<% } %>
+      # #1505: require a positive tool-specific mutant count; empty or unrecognized output fails closed.
+      - name: Fail when the mutation run produced no mutants (#1505)
+        if: steps.nightly.outputs.fresh != 'true'
+        run: |
+          if [ ! -s mutation-fallback.log ]; then
+            echo "::error::No mutation output captured — failing closed (an empty run is not a pass)."
+            exit 1
+          fi
+          if ! grep -Eqi 'tests per mutant|mutation score|[1-9][0-9]* mutants|Generated [1-9][0-9]* mutations|total is [1-9]|Caught [1-9]|KILLED|SURVIVED' mutation-fallback.log; then
+            echo "::error::Mutation run generated zero mutants — an empty run is not a pass (#1505)."
+            exit 1
+          fi
+          echo "Mutation run produced mutants — fail-on-empty check passed."
+
+  secret-scan-history:
+    name: Full-history secret scan
+    needs: [build-superset]
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+      # #2100: stale /tmp/gitleaks.tmp on self-hosted runners breaks gitleaks-action retries.
+      # ponytail: delete assumes one download per runner; concurrent jobs need the
+      # curl -> $RUNNER_TEMP/bin installation used in 01-pr-fast.
+      - name: Clear stale gitleaks download temp
+        run: rm -f /tmp/gitleaks.tmp
+      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e  # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          args: '--log-opts --full-history'
+
+  sbom:
+    name: Generate SBOM
+    needs: [build-superset]
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+<% if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+      - name: Generate CycloneDX SBOM
+        run: npm sbom --omit dev --package-lock-only --sbom-format cyclonedx > sbom.cdx.json
+<%# #1803/#1724: CycloneDX reads the dependency graph equally for Java and Kotlin. -%>
+<% } else if (language === 'java' || language === 'kotlin') { %>
+      - uses: ./.github/actions/setup-java-maven
+<% if (buildTool === 'gradle') { %>
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a  # v4
+      - name: Generate CycloneDX SBOM
+        run: ./gradlew cyclonedxBom
+      - run: mv build/reports/bom.json sbom.cdx.json 2>/dev/null || mv build/reports/bom.xml sbom.cdx.xml || true
+<% } else { %>
+      - name: Generate CycloneDX SBOM
+        run: mvn cyclonedx:makeAggregateBom
+      - run: mv target/bom.json sbom.cdx.json 2>/dev/null || mv target/bom.xml sbom.cdx.xml || true
+<% } %>
+<% } else if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: Generate SBOM via syft
+        uses: anchore/sbom-action@f6c3d0fe42c3cf876e3462574e4c9416b5e0f07a  # v0.9.0
+        with:
+          path: .
+          output-file: sbom.cdx.json
+          format: cyclonedx-json
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version-file: .python-version
+      - run: pip install cyclonedx-bom
+      - name: Generate CycloneDX SBOM
+        run: python -m cyclonedx_py auto > sbom.cdx.json || true
+<% } else if (language === 'rust') { %>
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+      - name: Generate CycloneDX SBOM
+        run: |
+          cargo install cargo-cyclonedx --locked || true
+          cargo cyclonedx --format json || true
+          mv bom.json sbom.cdx.json 2>/dev/null || echo '{"bomFormat":"CycloneDX"}' > sbom.cdx.json
+<% } %>
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: sbom
+          path: sbom.cdx.*
+          retention-days: 90
+
+  cosign-sign:
+    name: Sign artifact (cosign keyless)
+    needs: [build-superset, mutation-blocking, secret-scan-history, trivy-fs-scan]
+    if: github.event_name != 'pull_request'
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-artifact
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+      - name: Sigstore preflight check
+        run: |
+          STATUS=$(curl -sf https://status.sigstore.dev/api/v2/status.json \
+            --max-time 10 | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('status',{}).get('indicator','unknown'))" 2>/dev/null || echo "unknown")
+          if [[ "$STATUS" != "none" ]]; then
+            echo "::warning::Sigstore status is '${STATUS}' — cosign sign may fail"
+          fi
+          echo "sigstore-status=$STATUS"
+      - name: Sign artifact (keyless OIDC)
+        run: cosign sign-blob --yes <%= _artifact %> --bundle <%= _artifact %>.bundle
+<% if (_verifyOnSign) { %>
+      - name: Verify signature (L2+ strict)
+        run: |
+          cosign verify-blob \
+            --bundle <%= _artifact %>.bundle \
+            --certificate-identity-regexp ".*" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+            <%= _artifact %>
+<% } %>
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: cosign-bundle
+          path: <%= _artifact %>.bundle
+          retention-days: 90
+
+  slsa-provenance:
+    name: SLSA provenance (<%= _slsaL3 ? 'L3 hermetic' : 'L2 signed' %>)
+    needs: [build-superset]
+    if: github.event_name != 'pull_request'
+    permissions:
+      id-token: write
+      contents: write
+      actions: read
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a  # v2.1.0
+    with:
+      base64-subjects: ${{ needs.build-superset.outputs.hashes }}
+
+  attest-build-provenance:
+    name: Attest build provenance
+    needs: [build-superset]
+    if: github.event_name != 'pull_request'
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    permissions:
+      id-token: write
+      attestations: write
+      contents: read
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-artifact
+      - uses: actions/attest-build-provenance@520aba26e2f010aaab88f4a9c58cdbb3f3965fc2  # v2
+        with:
+          subject-path: <%= _artifact %>
+
+<% if (_isService) { %>
+  trivy-strict-release:
+    name: Trivy scan — release gate (service)
+    needs: [cosign-sign, attest-build-provenance, slsa-provenance]
+    if: github.event_name != 'pull_request'
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_BUILD || '["ubuntu-latest"]') }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
+        with:
+          driver: docker
+      - name: Restore Trivy DB cache
+        uses: actions/cache/restore@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
+        with:
+          path: ${{ runner.temp }}/trivy-db
+          key: ${{ runner.os }}-trivy-db-v1-${{ github.run_id }}
+          restore-keys: |
+            ${{ runner.os }}-trivy-db-v1-
+      - name: Build Docker image for scanning
+        run: |
+          docker build --load \
+            -t "${{ vars.IMAGE_NAME || 'app' }}:release-scan-${{ github.sha }}" \
+            .
+      - name: Export image to tar
+        run: docker save "${{ vars.IMAGE_NAME || 'app' }}:release-scan-${{ github.sha }}" -o "${{ runner.temp }}/image.tar"
+      - name: Trivy scan — block on HIGH/CRITICAL (security invariant before push)
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
+        with:
+          input: ${{ runner.temp }}/image.tar
+          format: table
+          exit-code: '1'
+          severity: 'HIGH,CRITICAL'
+          trivyignores: .trivyignore
+          cache-dir: ${{ runner.temp }}/trivy-db
+      - name: Save Trivy DB cache
+        if: always()
+        uses: actions/cache/save@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
+        with:
+          path: ${{ runner.temp }}/trivy-db
+          key: ${{ runner.os }}-trivy-db-v1-${{ github.run_id }}
+      - name: Cleanup
+        if: always()
+        run: |
+          docker rmi "${{ vars.IMAGE_NAME || 'app' }}:release-scan-${{ github.sha }}" 2>/dev/null || true
+          rm -f "${{ runner.temp }}/image.tar"
+
+  build-container:
+    name: Build and sign container (service)
+    needs: [cosign-sign, attest-build-provenance, slsa-provenance, trivy-strict-release]
+    if: github.event_name != 'pull_request'
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3
+      - name: Configure Docker credential store (macOS keychain bypass)
+        if: runner.os == 'macOS'
+        run: |
+          mkdir -p "$HOME/.docker"
+          echo '{"credsStore":""}' > "$HOME/.docker/config.json"
+      - uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c  # v4.5.2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051  # v5
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=sha
+      - name: Build and push container image
+        id: build
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          sbom: true
+          provenance: mode=max
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+      - name: Sigstore preflight check
+        run: |
+          STATUS=$(curl -sf https://status.sigstore.dev/api/v2/status.json \
+            --max-time 10 | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('status',{}).get('indicator','unknown'))" 2>/dev/null || echo "unknown")
+          if [[ "$STATUS" != "none" ]]; then
+            echo "::warning::Sigstore status is '${STATUS}' — cosign sign may fail"
+          fi
+          echo "sigstore-status=$STATUS"
+      - name: Sign container image (keyless OIDC)
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: cosign sign --yes ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}
+<% if (_slsaL3) { %>
+      - name: Verify container signature (L3 strict)
+        run: |
+          cosign verify \
+            --certificate-identity-regexp "https://github.com/${{ github.repository }}/" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+            ghcr.io/${{ github.repository }}@${{ steps.build.outputs.digest }}
+<% } %>
+<% } else if (_isCli) { %>
+  build-binaries:
+    name: Build multi-arch binaries (cli)
+    needs: [cosign-sign, attest-build-provenance, slsa-provenance]
+    if: github.event_name != 'pull_request'
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+<% if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: go.mod
+      - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a  # v6
+        with:
+          version: latest
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+<% } else if (language === 'rust') { %>
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+      - uses: cargo-bins/cargo-binstall@7884deddd95d515c3701294cf61a8b96cccc123b  # main @ 2026-05-28
+      - run: cargo binstall cargo-dist --no-confirm
+      - name: Build release binaries
+        run: cargo dist build --output-format=archive
+      - name: Upload binaries to GitHub release
+        run: gh release upload ${{ github.ref_name }} dist/*.tar.gz dist/*.zip --clobber
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version-file: .python-version
+      - run: pip install pyinstaller
+      - name: Build standalone binary
+        run: pyinstaller --onefile --name app src/main.py
+      - name: Upload binary to GitHub release
+        run: gh release upload ${{ github.ref_name }} dist/app --clobber
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+<% } else if (language === 'java') { %>
+      - name: Setup GraalVM for native compilation
+        uses: graalvm/setup-graalvm@bef4b0e916c7dd079bf60fb95d49139f67e32c5f  # v1
+        with:
+          java-version: '21'
+          distribution: graalvm
+          native-image-job-reports: 'true'
+<% if (buildTool === 'gradle') { %>
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a  # v4
+      - name: Build native binary
+        run: ./gradlew nativeCompile
+      - name: Upload native binary to GitHub release
+        run: gh release upload ${{ github.ref_name }} build/native/nativeCompile/* --clobber
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+<% } else { %>
+      - name: Build native binary
+        run: mvn -B -Pnative native:compile
+      - name: Upload native binary to GitHub release
+        run: gh release upload ${{ github.ref_name }} target/* --clobber
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+<% } %>
+<% } else if (language === 'typescript') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+      - run: npm run build
+      - name: Bundle to single file
+        run: npx @vercel/ncc build dist/index.js -o bundle/
+      - name: Upload bundle to GitHub release
+        run: gh release upload ${{ github.ref_name }} bundle/index.js --clobber
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+<% } %>
+<% } else if (_isBatch) { %>
+  bundle-artifact:
+    name: Bundle batch artifact
+    needs: [cosign-sign, attest-build-provenance, slsa-provenance]
+    if: github.event_name != 'pull_request'
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-artifact
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: sbom
+      - name: Create release manifest
+        run: |
+          cat <<EOF > manifest.json
+          {"version":"${{ github.ref_name }}","sha":"${{ github.sha }}","artifact":"<%= _artifact %>","sbom":"sbom.cdx.json"}
+          EOF
+      - name: Bundle with manifest
+        run: tar -czf batch-bundle.tar.gz <%= _artifact %> manifest.json sbom.cdx.*
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+      - name: Sign batch bundle (keyless)
+        run: cosign sign-blob --yes batch-bundle.tar.gz --bundle batch-bundle.tar.gz.bundle
+      - name: Upload to GitHub release
+        run: |
+          gh release upload ${{ github.ref_name }} \
+            batch-bundle.tar.gz \
+            batch-bundle.tar.gz.bundle \
+            manifest.json \
+            --clobber
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: batch-bundle
+          path: |
+            batch-bundle.tar.gz
+            batch-bundle.tar.gz.bundle
+            manifest.json
+          retention-days: 90
+<% } else { %>
+  publish-package:
+    name: Publish package (lib)
+    needs: [cosign-sign, attest-build-provenance, slsa-provenance, sbom, doc-freshness-gate]
+    # #2138/#2624: tag-shaped refs alone also admit manual dispatch; require a push.
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+<% if (_npmLib) { %>
+    runs-on: ubuntu-latest
+<% } else { %>
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+<% } %>
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      id-token: write  # required by `npm publish --provenance` (OIDC)
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          ref: ${{ github.ref }}
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: release-artifact
+      - name: Verify the downloaded artifact is the one that was signed (#2138)
+        # #2138: reject downloaded bytes that differ from the signed build artifact.
+        run: sha256sum -c sha256sums.txt
+<% if (language === 'typescript') { %>
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version-file: .nvmrc
+          package-manager-cache: false
+          registry-url: https://registry.npmjs.org
+      - run: npm install --global npm@11.16.0
+      - name: Verify release tag matches package version
+        id: release-version
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          VERSION=$(tar -xOf <%= _artifact %> package/package.json | node -e "const v=JSON.parse(require('node:fs').readFileSync(0,'utf8')).version; if(typeof v!=='string'||!v) process.exit(1); process.stdout.write(v)")
+          test "$RELEASE_TAG" = "v$VERSION" || { echo "::error::Release tag does not match archive package.json"; exit 1; }
+      - name: Publish to npm (with provenance)
+        # #2138: never repack here: prepack would change the attested bytes.
+        run: npm publish --provenance --access public <%= _artifact %>
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+<% } else if (language === 'java') { %>
+      - uses: ./.github/actions/setup-java-maven
+<% if (buildTool === 'gradle') { %>
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a  # v4
+      - name: Publish to Maven Central
+        run: ./gradlew publish
+        env:
+          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+          ORG_GRADLE_PROJECT_signingKey: ${{ secrets.GPG_SIGNING_KEY }}
+          ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.GPG_SIGNING_PASSWORD }}
+<% } else { %>
+      - name: Publish to Maven Central
+        run: mvn --batch-mode deploy -DskipTests
+        env:
+          MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.MAVEN_PASSWORD }}
+<% } %>
+<% } else if (language === 'go') { %>
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: Create GitHub release
+        run: gh release create ${{ github.ref_name }} <%= _artifact %> sha256sums.txt --generate-notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+<% } else if (language === 'python') { %>
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version-file: .python-version
+      - run: pip install build twine
+      - run: python -m build
+      - name: Publish to PyPI
+        run: twine upload dist/*
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+<% } else if (language === 'rust') { %>
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+      - name: Publish to crates.io
+        run: cargo publish --no-verify
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+<% } %>
+<% } %>
+
+  doc-freshness-gate:
+    name: Per-doc freshness gate (T4, gold-doc-tranches-t3-t5.md §2.3 — release-tag blocking)
+    needs: [build-superset]
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          fetch-depth: 0
+      - uses: ./.github/actions/setup-node-pnpm
+      - name: Per-doc freshness audit — no stale gold doc ships in a tagged release
+        run: node scripts/check-doc-freshness.mjs
+
+  release-required:
+    name: Release gate
+    needs:
+      - mutation-blocking
+      - secret-scan-history
+      - trivy-fs-scan
+      - sbom
+      - cosign-sign
+      - slsa-provenance
+      - attest-build-provenance
+      - doc-freshness-gate
+<% if (_isService) { %>
+      - build-container
+<% } else if (_isCli) { %>
+      - build-binaries
+<% } else if (_isBatch) { %>
+      - bundle-artifact
+<% } else { %>
+      - publish-package
+<% } %>
+<% if (_npmLib) { %>
+    if: always() && github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+<% } else { %>
+    if: always()
+<% } %>
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    timeout-minutes: 60
+    steps:
+      - name: Release gate summary
+        id: release-results
+        env:
+          NEEDS_JSON: ${{ toJSON(needs) }}
+        run: |
+          jq -e 'length > 0 and all(.[]; .result == "success")' <<< "$NEEDS_JSON" >/dev/null
+          echo "Release checks completed."
+          echo "Signing, provenance, and mutation verified."