security-release-gate.yml

name: Security release gate

on:
  push:
    branches:
      - 'verification/node-agent-*'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: node-agent-security-${{ github.ref }}
  cancel-in-progress: false

jobs:
  build-test-scan:
    runs-on: ubuntu-24.04
    timeout-minutes: 120
    env:
      DAPPER_IMAGE: pasturestack/node-agent-dapper:${{ github.sha }}
      RUNTIME_IMAGE: pasturestack/node-agent:v0.13.34
      TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
      VERSION_OVERRIDE: v0.13.34
    steps:
      - name: Check out candidate
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Record immutable source identity
        shell: bash
        run: |
          set -euo pipefail
          test -z "$(git status --porcelain)"
          git merge-base --is-ancestor 73e3a7c5f438dbda42c4078885a66e6f156aa731 HEAD
          mkdir -p evidence
          git rev-parse HEAD > evidence/source-revision.txt
          sha256sum Dockerfile.dapper package/Dockerfile tests/requirements.lock \
            scripts/package scripts/verify-package \
            .github/workflows/codeql-verification.yml \
            .github/workflows/security-release-gate.yml \
            security/dapper.openvex.json \
            security/buildx.openvex.json toolchain/build-buildx \
            .github/scripts/scan-dapper-container-binaries.sh \
            .github/scripts/check_buildx_code_absence.py \
            .github/scripts/test_buildx_code_absence.py \
            .github/scripts/join_buildx_native_vex.py \
            .github/scripts/test_join_buildx_native_vex.py \
            .github/scripts/check_buildx_additional_scopes.py \
            .github/scripts/test_buildx_additional_scopes.py security/buildx-source-scopes/*.json \
            scripts/pip-security/check-pip-vendor-slice.py scripts/pip-security/filter-pip-vendor-findings.py \
            scripts/pip-security/test-pip-vex.py tests/requirements.lock tests/requirements.txt \
            > evidence/source-locks.sha256

      - name: Validate Buildx source applicability guards
        run: |
          python3 -B .github/scripts/test_buildx_code_absence.py
          python3 -B .github/scripts/test_join_buildx_native_vex.py
          python3 -B .github/scripts/test_buildx_additional_scopes.py

      - name: Run complete CI and package runtime image
        shell: bash
        run: |
          set -euo pipefail
          CROSS=1 VERSION_OVERRIDE="$VERSION_OVERRIDE" make DAPPER_IMAGE="$DAPPER_IMAGE" ci
          make DAPPER_IMAGE="$DAPPER_IMAGE" IMAGE_NAME=pasturestack/node-agent \
            TAG=v0.13.34 VERSION_OVERRIDE="$VERSION_OVERRIDE" package-image
          test -s dist/artifacts/node-agent-0.13.34.tar.gz
          test -s dist/artifacts/node-agent-0.13.34-windows-amd64.zip
          test "$(cat dist/image)" = "$RUNTIME_IMAGE"
          gzip -t dist/artifacts/node-agent-0.13.34.tar.gz
          bash scripts/verify-package dist/artifacts/node-agent-0.13.34.tar.gz
          unzip -t dist/artifacts/node-agent-0.13.34-windows-amd64.zip
          (
            cd dist/artifacts
            sha256sum node-agent-0.13.34.tar.gz node-agent-0.13.34-windows-amd64.zip > SHA256SUMS
            sha256sum -c SHA256SUMS
          )
          sha256sum dist/artifacts/node-agent-0.13.34.tar.gz \
            dist/artifacts/node-agent-0.13.34-windows-amd64.zip \
            bin/node-agent bin/windows/amd64/node-agent.exe > evidence/product-artifacts.sha256
          docker image inspect "$RUNTIME_IMAGE" > evidence/runtime-image-inspect.json
          docker run --rm --entrypoint /usr/bin/node-agent "$RUNTIME_IMAGE" --version \
            > evidence/runtime-version.txt
          grep -Fxq 'node-agent version v0.13.34' evidence/runtime-version.txt

      - name: Verify reproducible Linux binary
        shell: bash
        run: |
          set -euo pipefail
          cp bin/node-agent /tmp/node-agent.first
          rm -f bin/node-agent
          VERSION_OVERRIDE="$VERSION_OVERRIDE" make DAPPER_IMAGE="$DAPPER_IMAGE" build
          cmp /tmp/node-agent.first bin/node-agent
          docker run --rm --entrypoint go -v "$PWD:/work:ro" "$DAPPER_IMAGE" \
            version -m /work/bin/node-agent > evidence/product-go-version.txt
          grep -F 'go1.27.3' evidence/product-go-version.txt >/dev/null
          grep -F $'build\tCGO_ENABLED=0' evidence/product-go-version.txt >/dev/null
          docker run --rm --entrypoint go -v "$PWD:/work:ro" "$DAPPER_IMAGE" \
            version -m /work/bin/windows/amd64/node-agent.exe > evidence/windows-product-go-version.txt
          grep -F 'go1.27.3' evidence/windows-product-go-version.txt >/dev/null
          grep -F $'build\tGOOS=windows' evidence/windows-product-go-version.txt >/dev/null
          for report in evidence/product-go-version.txt evidence/windows-product-go-version.txt; do
            grep -Fx $'\tbuild\tvcs.revision='"$GITHUB_SHA" "$report" >/dev/null
            grep -Fx $'\tbuild\tvcs.modified=false' "$report" >/dev/null
          done

      - name: Scan source, product, runtime, and build image
        shell: bash
        run: |
          set -euo pipefail
          docker pull "$TRIVY_IMAGE"
          cache="$RUNNER_TEMP/trivy-cache"
          source_tree="$(mktemp -d)"
          product_tree="$(mktemp -d)"
          mkdir -p "$cache" "$product_tree"
          trap 'rm -rf "$source_tree" "$product_tree"' EXIT
          git archive --format=tar HEAD | tar -xf - -C "$source_tree"
          cp bin/node-agent "$product_tree/node-agent"
          unzip -p dist/artifacts/node-agent-0.13.34-windows-amd64.zip pasturestack/node-agent.exe > "$product_tree/node-agent.exe"
          test -s "$product_tree/node-agent.exe"
          docker run --rm -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image --download-db-only
          docker run --rm -v "$source_tree:/scan:ro" -v "$PWD/evidence:/evidence" \
            -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" fs \
            --skip-db-update --offline-scan --scanners vuln,secret --format json \
            --output /evidence/source-security.json /scan
          docker run --rm -v "$product_tree:/scan:ro" -v "$PWD/evidence:/evidence" \
            -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" rootfs \
            --skip-db-update --offline-scan --scanners vuln,secret --format json \
            --output /evidence/product-security.json /scan
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$PWD:/work" -w /work -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \
            --skip-db-update --offline-scan --scanners vuln,secret --list-all-pkgs --format json \
            --output /work/evidence/runtime-security.json "$RUNTIME_IMAGE"
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$PWD:/work" -w /work -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \
            --skip-db-update --offline-scan --scanners vuln,secret --list-all-pkgs --format json \
            --output /work/evidence/dapper-security-image.json "$DAPPER_IMAGE"
          bash .github/scripts/scan-dapper-container-binaries.sh "$DAPPER_IMAGE" "$TRIVY_IMAGE" "$cache"
          jq -n --slurpfile source evidence/buildx-source-input.json \
            --slurpfile baseGuard evidence/buildx-code-absence.json \
            --rawfile pluginFix security/buildx-source-scopes/CVE-2026-33997-official-commit.json \
            --rawfile plugin security/buildx-source-scopes/GO-2026-4883.json \
            --rawfile copy security/buildx-source-scopes/GO-2026-5668.json \
            --rawfile openpgp security/buildx-source-scopes/GO-2026-5932.json \
            '{source:$source[0],baseGuard:$baseGuard[0],pluginFix:$pluginFix,osv:{"GO-2026-4883":$plugin,"GO-2026-5668":$copy,"GO-2026-5932":$openpgp}}' \
            > evidence/buildx-additional-input.json
          python3 -B .github/scripts/check_buildx_additional_scopes.py \
            < evidence/buildx-additional-input.json > evidence/buildx-additional-qualification.json
          docker run --rm --entrypoint python3 "$DAPPER_IMAGE" \
            /opt/python-security/scripts/check-pip-vendor-slice.py \
            > evidence/pip-vendor-proof.json
          docker run --rm --entrypoint dockerd "$DAPPER_IMAGE" --version > evidence/dockerd-version.txt
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$PWD:/work" -w /work -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \
            --skip-db-update --offline-scan --format cyclonedx \
            --output /work/evidence/dapper.cdx.json "$DAPPER_IMAGE"
          python3 scripts/pip-security/test-pip-vex.py
          python3 scripts/pip-security/filter-pip-vendor-findings.py \
            --raw evidence/dapper-security-buildx.json --proof evidence/pip-vendor-proof.json --sbom evidence/dapper.cdx.json \
            --output evidence/dapper-security.json --vex evidence/pip-vendor.openvex.json \
            --subject "$(docker image inspect --format '{{.Id}}' "$DAPPER_IMAGE")"
          docker run --rm --entrypoint sh "$DAPPER_IMAGE" -lc \
            "printf 'package\\tversion\\n'; dpkg-query -W -f='\${binary:Package}\\t\${Version}\\n' | LC_ALL=C sort" \
            > evidence/dapper-dpkg.tsv
          jq -r '
            .Results[]?.Vulnerabilities[]?
            | select(.Severity == "CRITICAL" or .Severity == "HIGH")
            | [.VulnerabilityID, .PkgIdentifier.PURL]
            | @tsv
          ' evidence/dapper-security.json | LC_ALL=C sort -u \
            > /tmp/dapper-critical-high.tsv
          jq -r '
            .statements[]?
            | select(
                .status == "not_affected"
                and .justification == "vulnerable_code_not_present"
              )
            | .vulnerability.name as $id
            | .products[]?
            | [$id, .["@id"]]
            | @tsv
          ' security/dapper.openvex.json | LC_ALL=C sort -u \
            > /tmp/dapper-vex.tsv
          test -s /tmp/dapper-critical-high.tsv
          diff -u /tmp/dapper-critical-high.tsv /tmp/dapper-vex.tsv
          test "$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL" or .Severity == "HIGH")] | length' evidence/dapper-security.json)" \
            -eq "$(wc -l < /tmp/dapper-critical-high.tsv)"
          test "$(jq '.statements | length' security/dapper.openvex.json)" \
            -eq "$(wc -l < /tmp/dapper-vex.tsv)"
          jq -e '
            all(
              .statements[];
              .status == "not_affected"
              and .justification == "vulnerable_code_not_present"
              and ((.impact_statement | type) == "string")
              and ((.impact_statement | length) > 0)
            )
          ' security/dapper.openvex.json >/dev/null
          grep -F $'linux-libc-dev:amd64\t7.0.0-38.38' evidence/dapper-dpkg.tsv >/dev/null
          if grep -Eq '^linux-(image|modules)([-:]|[[:space:]])' evidence/dapper-dpkg.tsv; then
            printf 'Unexpected Linux kernel runtime package in Dapper image\n' >&2
            exit 1
          fi
          test -z "$(docker run --rm --entrypoint sh "$DAPPER_IMAGE" -lc \
            "find /boot /lib/modules /usr/lib/modules -type f 2>/dev/null | head -n 1")"
          cp /tmp/dapper-critical-high.tsv evidence/dapper-critical-high.tsv
          cp /tmp/dapper-vex.tsv evidence/dapper-openvex.tsv
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$PWD:/work" -w /work -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \
            --skip-db-update --offline-scan --format cyclonedx \
            --output /work/evidence/runtime.cdx.json "$RUNTIME_IMAGE"
          mkdir -p evidence
          consumer_container=$(docker create "$RUNTIME_IMAGE" /bin/true)
          if docker cp "$consumer_container:/usr/share/pasturestack/security/ubuntu-backports" evidence/ubuntu-backports; then
              docker rm "$consumer_container" >/dev/null
          else
              docker rm "$consumer_container" >/dev/null
              exit 1
          fi
          (cd evidence/ubuntu-backports && sha256sum --check SHA256SUMS)
          bundle_image='ghcr.io/pasturestack/ubuntu-security-backports:v0.1.0@sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a'
          mkdir -p evidence/bundle-tools
          bundle_container=$(docker create "$bundle_image" unused)
          if docker cp "$bundle_container:/out/verify-consumer-evidence.py" evidence/bundle-tools/verify-consumer-evidence.py && \
              docker cp "$bundle_container:/out/SHA256SUMS" evidence/bundle-tools/SHA256SUMS; then
              docker rm "$bundle_container" >/dev/null
          else
              docker rm "$bundle_container" >/dev/null
              exit 1
          fi
          (cd evidence/bundle-tools && \
              test "$(grep -Ec '^[0-9a-f]{64}  verify-consumer-evidence\.py$' SHA256SUMS)" -eq 1 && \
              grep -E '^[0-9a-f]{64}  verify-consumer-evidence\.py$' SHA256SUMS | sha256sum --check -)
          python3 evidence/bundle-tools/verify-consumer-evidence.py \
              --evidence-dir evidence/ubuntu-backports --sbom evidence/runtime.cdx.json \
              --bundle-checksums evidence/bundle-tools/SHA256SUMS \
              --expected-bundle-digest 'sha256:2742a3d429e4e14bc587f6dedc51ded4246cf90bbaedcd86c67d0885e32a6f2a' > evidence/ubuntu-backports-validation.json
          docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
            -v "$PWD:/work" -w /work -v "$cache:/root/.cache/trivy" "$TRIVY_IMAGE" image \
            --skip-db-update --offline-scan --scanners vuln,secret --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL \
            --vex /work/evidence/ubuntu-backports/openvex.json --format json \
            --output /work/evidence/runtime-security.effective.json "$RUNTIME_IMAGE"

      - name: Enforce zero applicable Critical, High, or secrets
        shell: bash
        run: |
          set -euo pipefail
          : > evidence/security-summary.txt
          for scope in source product runtime; do
            report="evidence/${scope}-security.json"
            if [ "$scope" = runtime ]; then report=evidence/runtime-security.effective.json; fi
            secrets=$(jq '[.Results[]?.Secrets[]?] | length' "$report")
            critical=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length' "$report")
            high=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length' "$report")
            printf '%s_secrets=%s\n%s_critical=%s\n%s_high=%s\n' \
              "$scope" "$secrets" "$scope" "$critical" "$scope" "$high" \
              | tee -a evidence/security-summary.txt
            test "$secrets" -eq 0
            test "$critical" -eq 0
            test "$high" -eq 0
          done
          dapper_secrets=$(jq '[.Results[]?.Secrets[]?] | length' evidence/dapper-security.json)
          dapper_raw_critical=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length' evidence/dapper-security.json)
          dapper_raw_high=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length' evidence/dapper-security.json)
          dapper_reviewed_critical=$(jq -n \
            --rawfile pairs evidence/dapper-critical-high.tsv \
            --slurpfile report evidence/dapper-security.json \
            '[($pairs | split("\n")[] | select(length > 0) | split("\t") as $pair | {id:$pair[0],purl:$pair[1]})] as $pairs
            | [$report[0].Results[]?.Vulnerabilities[]?
               | select(.Severity == "CRITICAL")
               | select(.VulnerabilityID as $id | .PkgIdentifier.PURL as $purl | $pairs | any(.id == $id and .purl == $purl))]
            | length')
          dapper_reviewed_high=$(jq -n \
            --rawfile pairs evidence/dapper-critical-high.tsv \
            --slurpfile report evidence/dapper-security.json \
            '[($pairs | split("\n")[] | select(length > 0) | split("\t") as $pair | {id:$pair[0],purl:$pair[1]})] as $pairs
            | [$report[0].Results[]?.Vulnerabilities[]?
               | select(.Severity == "HIGH")
               | select(.VulnerabilityID as $id | .PkgIdentifier.PURL as $purl | $pairs | any(.id == $id and .purl == $purl))]
            | length')
          dapper_applicable_critical=$((dapper_raw_critical - dapper_reviewed_critical))
          dapper_applicable_high=$((dapper_raw_high - dapper_reviewed_high))
          jq -n \
            --arg method 'exact-id-purl-set-match' \
            --arg source 'evidence/dapper-security.json' \
            --arg vex 'security/dapper.openvex.json' \
            --argjson raw_critical "$dapper_raw_critical" \
            --argjson raw_high "$dapper_raw_high" \
            --argjson reviewed_critical "$dapper_reviewed_critical" \
            --argjson reviewed_high "$dapper_reviewed_high" \
            --argjson applicable_critical "$dapper_applicable_critical" \
            --argjson applicable_high "$dapper_applicable_high" \
            '{method:$method,source_report:$source,vex_document:$vex,raw:{critical:$raw_critical,high:$raw_high},reviewed_not_affected:{critical:$reviewed_critical,high:$reviewed_high},applicable:{critical:$applicable_critical,high:$applicable_high}}' \
            > evidence/dapper-openvex-review.json
          printf 'dapper_secrets=%s\ndapper_raw_critical=%s\ndapper_raw_high=%s\ndapper_applicable_critical=%s\ndapper_applicable_high=%s\n' \
            "$dapper_secrets" "$dapper_raw_critical" "$dapper_raw_high" \
            "$dapper_applicable_critical" "$dapper_applicable_high" \
            | tee -a evidence/security-summary.txt
          test "$dapper_secrets" -eq 0
          test "$dapper_applicable_critical" -eq 0
          test "$dapper_applicable_high" -eq 0
          python3 - <<'PY'
          import json
          for scope in ('runtime', 'dapper'):
              with open('evidence/{}.cdx.json'.format(scope), encoding='utf-8') as stream:
                  bom = json.load(stream)
              assert bom.get('bomFormat') == 'CycloneDX'
              assert str(bom.get('specVersion')) == '1.7'
              assert len(bom.get('components', [])) > 0
              print('{}_components={}'.format(scope, len(bom['components'])))
          PY

      - name: Enforce full runtime vulnerability policy
        run: |
          bash .github/scripts/check-builder-header-boundary.sh "$DAPPER_IMAGE" > evidence/dapper-header-boundary.json
          python3 .github/scripts/test_builder_vulnerability_policy.py
          python3 .github/scripts/test_node_builder_vex.py
          cp security/dapper-runtime-metadata.openvex.json evidence/
          python3 .github/scripts/enforce-runtime-vulnerabilities.py --scope builder --repository PastureStack/node-agent < evidence/dapper-security.json
          python3 .github/scripts/test_runtime_vulnerability_policy.py
          python3 .github/scripts/enforce-runtime-vulnerabilities.py --repository PastureStack/node-agent < evidence/runtime-security.effective.json
          python3 .github/scripts/enforce-runtime-vulnerabilities.py --repository PastureStack/node-agent < evidence/product-security.json

      - name: Retain exact runtime for immutable release
        shell: bash
        run: |
          set -euo pipefail
          mkdir -p dist/security-runtime
          docker image inspect "$RUNTIME_IMAGE" > dist/security-runtime/images.json
          docker save "$RUNTIME_IMAGE" | gzip -n > dist/security-runtime/images.tar.gz
          cp evidence/runtime-security.json evidence/runtime-security.effective.json evidence/runtime.cdx.json dist/security-runtime/
          tar -cf dist/security-runtime/ubuntu-backports-evidence.tar -C evidence ubuntu-backports ubuntu-backports-validation.json
          cp dist/artifacts/node-agent-0.13.34.tar.gz dist/artifacts/node-agent-0.13.34-windows-amd64.zip dist/security-runtime/
          printf '%s\n' "$GITHUB_SHA" > dist/security-runtime/source-revision.txt
          (cd dist/security-runtime && sha256sum -- * > SHA256SUMS)
      - name: Upload exact runtime release bytes
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: security-runtime-${{ github.sha }}
          path: dist/security-runtime/
          if-no-files-found: error
          retention-days: 14

      - name: Retain exact scanned release packages
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: node-agent-scanned-0.13.34
          path: |
            dist/artifacts/node-agent-0.13.34.tar.gz
            dist/artifacts/node-agent-0.13.34-windows-amd64.zip
            dist/artifacts/SHA256SUMS
          if-no-files-found: error
          retention-days: 30
          compression-level: 0

      - name: Upload reviewed evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: node-agent-security-${{ github.sha }}
          path: evidence/
          if-no-files-found: error
          retention-days: 30
          compression-level: 9

      - name: Clean runner resources
        if: always()
        shell: bash
        run: |
          set +e
          docker rm -f $(docker ps -aq --filter ancestor="$DAPPER_IMAGE") 2>/dev/null
          docker image rm -f "$DAPPER_IMAGE" "$RUNTIME_IMAGE" "$TRIVY_IMAGE" 2>/dev/null
          docker builder prune --all --force >/dev/null 2>&1
          sudo rm -rf bin build dist