build(release): bind reviewed source to SBOM and provenance evidence

[seonghobae]

Purpose

Advance release/supply-chain evidence without publishing from an unready product head. This Draft is a repository-owned foundation slice: one reviewed Rust source identity produces a deterministic binary archive, source/build hashes, SPDX JSON SBOM and machine-readable manifest; only a protected-main manual-dispatch attestation job may mint provenance/SBOM attestations.

This PR remains intentionally stacked on Rust-toolchain prerequisite #77. It is not a release or promotion vehicle by itself and does not create a tag, GitHub Release, container image, registry object, deployment or production promotion.

RED → GREEN lineage retained

• RED bf6ba08557b0900ef7959d8e9e2b83b0ad0f7fe9 introduced the release-evidence contract before the workflow existed.
• 5ce56d19e2c37ce1824b1d4d8657f6391387238f added source/version binding, locked quality gates, deterministic archive construction, SPDX generation and immutable action pins.
• RED 26541c9558b3c64363318e3042f787df3d019f65 proved scanning only the ELF could omit the locked dependency graph; GREEN 2bacb6c1b330e6c657195f2b77b32e9862479df6 packages Cargo.toml, Cargo.lock and rust-toolchain.toml beside the binary and scans the exact package directory.
• RED ea56a03acf747a0fc14ee85690cfce0eeeae1a56 proved the PR-executable build job must not hold attestation authority; GREEN c3b450ee321ff399a67d1d9d4d8d1f5ca0936b63 isolates attestation in a protected-main dispatch-only job.
• RED 3634074e2061c1f7b66a5de2fec0ce1e695a73e2 rejected unnecessary artifact-metadata: write; GREEN b040c878b9809a80f87d5bb52c3125512e4ba622 removed it.
• Actions RED 33806510290 exposed invalid job-level runner.temp; RED 3a34d35de477155c4bdb2d45f7f09db830f31800 made it executable policy and 1d3f5a4bd618084031f3e722804b7c61303baeb5 moved runner-only paths into step/runtime scope.
• Current intervening commit f5eb6d3f5df03ce221b396afbb76a708d18cbc2a is a formatting-only repair in tests/release_evidence_contract.rs and is adopted as current branch truth rather than treated as a race.

Current stack — 2026-09-05 KST

Current child head is exact f5eb6d3f5df03ce221b396afbb76a708d18cbc2a. GitHub records the PR Draft and mergeable, but its base still points at old parent #77@2f96565b9452ea49627b28f7ae380e07b68af115.

Live prerequisite #77 is now exact d386d6f57e0c8de3e4839d6c61b593e41f9d7e20, itself non-force integrated with protected main@5829a0f08d78de464dd24393ce5d0f25fba9d126 and behind_by=0. Therefore #164 is still a stack-repair candidate, not an integration candidate. Do not mechanically merge it into the stale parent or close it; after #77 becomes protected truth, retarget/non-force restack from fresh protected main and preserve every unique release-evidence delta.

Current exact child workflow evidence is historical for the future restacked head but remains useful diagnostic evidence: CI run 33878901387 completed success on f5eb6d3..., while Release evidence run 33878901452 completed cancelled; both Build exact-source release evidence and Attest protected-main release evidence jobs were cancelled. That is not release GREEN and cannot transfer after the required parent/protected-main restack.

Security and publication boundary

The PR-executable build job has only contents: read: it may build/test/SBOM/upload evidence but cannot mint OIDC-backed attestations. The separate protected-main dispatch job must bind requested version, exact protected source, manifest identity and recorded hashes before attestation, with only the minimum OIDC/attestation permissions.

This slice still does not close #84. Final release readiness requires protected auth/egress/data/enforcement prerequisites, final container-filesystem SBOM and immutable OCI digest, signature/provenance verification before admission/promotion, exact deployment/attack evidence, migration compatibility, canary criteria, independent evidence retention, and measured rollback/roll-forward.

Integration gate

Keep Draft until #77 or a verified successor is protected truth. Then non-force reconstruct this exact valid release-evidence delta on fresh protected main, reacquire repository/security/coverage/package/SBOM/provenance/current-review/thread/governance evidence on one unchanged exact head, and only then evaluate ordinary protected merge. No self/model approval, force push, routine bypass, publication from a feature branch, gate weakening or predecessor-evidence reuse.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Review-driven release-boundary repair on the current lineage:

• Finding verification: the original single release-evidence job granted id-token: write, attestations: write, and artifact-metadata: write even on pull_request, while also executing PR-controlled Rust/build-script code. Step-level if: workflow_dispatch on actions/attest did not remove the OIDC/attestation authority from the PR-executable job.
• Hostile RED ea56a03acf747a0fc14ee85690cfce0eeeae1a56 adds an executable workflow contract requiring the PR build job to have no attestation authority and requiring a separate protected-main-only attestation job.
• Minimal GREEN/current c3b450ee321ff399a67d1d9d4d8d1f5ca0936b63 leaves the build/evidence job at contents: read, exports only source/version identity, uploads the exact evidence bundle, and moves OIDC/attestation permissions into attest-release-evidence, gated to workflow_dispatch after the protected-main/version checks. That job downloads the exact SHA-named artifact using immutable actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c (v8.0.1), revalidates protected main, requested version, manifest source/version and all recorded artifact SHA-256 values before calling actions/attest.

This head supersedes 2bacb6c...; predecessor checks/reviews do not transfer. The branch remains Draft and stacked on #77. Exact-current-head execution is required before any further integration.