Skip to content
.github/workflows/hermetic.yml

feat(ops): Socket.dev posture SelfCheck gate (W43-B1, C06 L33) #618

Sign in to view logs

feat(ops): Socket.dev posture SelfCheck gate (W43-B1, C06 L33)

feat(ops): Socket.dev posture SelfCheck gate (W43-B1, C06 L33) #618

Workflow file for this run

.github/workflows/hermetic.yml at 9df48fd
name: Hermetic Build
on:
push:
branches: [main]
pull_request:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
CARGO_TERM_COLOR: always
RUSTFLAGS: "-D warnings"
jobs:
source-date-epoch-policy:
name: release · SOURCE_DATE_EPOCH policy
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
- name: verify SOURCE_DATE_EPOCH docs + release wiring
shell: pwsh
run: ./scripts/repro-check.ps1 -PolicyOnly
# Soft C06 L53 SLSA isolation checklist — docs/pin + isolated rebuild wiring
# (non-blocking). Single pinned container rebuild is evidence, not two-builder L3.
slsa-isolation-checklist:
name: hermetic · SLSA isolation checklist (soft)
runs-on: ubuntu-latest
continue-on-error: true
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
- name: SelfCheck SLSA isolation checklist + builder pin
shell: pwsh
run: ./scripts/slsa-isolation-check.ps1 -SelfCheck
# Soft C06 L60 exact rustc pin — toml/json/docs + CI wiring (non-blocking).
rustc-toolchain-pin:
name: hermetic · exact rustc toolchain pin (soft)
runs-on: ubuntu-latest
continue-on-error: true
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
- name: SelfCheck rust-toolchain.toml exact channel + CI uses pin
shell: pwsh
run: ./scripts/rustc-toolchain-check.ps1 -SelfCheck
sl-daemon-offline:
name: sl-daemon · locked offline build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
- uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
- name: cargo fetch then offline build
shell: pwsh
run: ./scripts/hermetic-check.ps1
# Soft C06 L53 reusable-workflow provenance — caller SHA pin + digest input
# (non-blocking). See docs/ops/reusable-hermetic-pin.md.
reusable-provenance-checklist:
name: hermetic · reusable workflow provenance (soft)
runs-on: ubuntu-latest
continue-on-error: true
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
- name: SelfCheck reusable workflow caller pin
shell: pwsh
run: ./scripts/reusable-provenance-check.ps1 -SelfCheck
# Reusable workflow — job-level call, pinned to SessionLedger commit SHA.
# Pin: b52c9f7bc15756a35e8f64789db6bcc0b042fd26 (see docs/ops/reusable-hermetic-pin.md)
sl-daemon-offline-container:
name: sl-daemon · repository builder image offline build
uses: KooshaPari/SessionLedger/.github/workflows/reusable-hermetic-build.yml@b52c9f7bc15756a35e8f64789db6bcc0b042fd26

Check failure on line 75 in .github/workflows/hermetic.yml

View workflow run for this annotation

GitHub Actions / .github/workflows/hermetic.yml

Invalid workflow file 

error parsing called workflow
".github/workflows/hermetic.yml"
-> "KooshaPari/SessionLedger/.github/workflows/reusable-hermetic-build.yml@b52c9f7bc15756a35e8f64789db6bcc0b042fd26"
: workflow was not found. See https://docs.github.com/actions/learn-github-actions/reusing-workflows#access-to-reusable-workflows for more information.
with:
builder_image_digest: sha256:fe71c757a13cb864e5f15f4a1384f63129b15bcd037bc44b46a056c814ca4cb7