Separate managed and resolved builder identity

.github/actions/validate-platform-compatibility/validate.mjs

@@ -57,7 +57,7 @@ const packageName = /^[a-z0-9][a-z0-9-]*$/;
 const digest = /^sha256:[0-9a-f]{64}$/;
 const image = /^[A-Za-z0-9][A-Za-z0-9._/-]*:[A-Za-z0-9][A-Za-z0-9._-]*@sha256:[0-9a-f]{64}$/;
 const runURL = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/actions\/runs\/[0-9]+$/;
-const certificateIdentity = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/\.github\/workflows\/build-push\.ya?ml@[0-9a-f]{40}$/;
+const certificateIdentity = /^https:\/\/github\.com\/libops\/\.github\/\.github\/workflows\/build-push\.yaml@refs\/(heads|tags)\/[A-Za-z0-9._/-]+$/;
 const callerWorkflowRef = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/\.github\/workflows\/[A-Za-z0-9_.-]+\.ya?ml@\S+$/;
 const families = new Set(["archivesspace", "drupal", "islandora", "ojs", "omeka-classic", "omeka-s", "wordpress"]);
 
@@ -205,8 +205,9 @@ function validateImage(item, path) {
   if (!image.test(item.reference)) die(`${path}.reference must contain an exact tag and sha256 digest`);
   source(item.source, `${path}.source`);
   const attestationsPath = `${path}.attestations`;
-  exactKeys(item.attestations, attestationsPath, ["certificateIdentity", "callerWorkflowRef", "sbom", "provenance"]);
-  if (!certificateIdentity.test(item.attestations.certificateIdentity)) die(`${attestationsPath}.certificateIdentity must bind the exact shared publisher commit`);
+  exactKeys(item.attestations, attestationsPath, ["certificateIdentity", "builderCommit", "callerWorkflowRef", "sbom", "provenance"]);
+  if (!certificateIdentity.test(item.attestations.certificateIdentity)) die(`${attestationsPath}.certificateIdentity must bind a managed shared-publisher ref`);
+  if (!sha.test(item.attestations.builderCommit)) die(`${attestationsPath}.builderCommit must bind the exact resolved shared-publisher commit`);
   if (!callerWorkflowRef.test(item.attestations.callerWorkflowRef)) die(`${attestationsPath}.callerWorkflowRef must identify the caller workflow and ref`);
   exactKeys(item.attestations.sbom, `${attestationsPath}.sbom`, ["predicateType", "platforms", "verificationRun"]);
   if (item.attestations.sbom.predicateType !== "https://spdx.dev/Document") die(`${attestationsPath}.sbom.predicateType is invalid`);

.github/compatibility/README.md

@@ -6,8 +6,8 @@ contract. The manifest is the exact, reviewable set that was tested together:
 
 - the Terraform source commit;
 - all 17 required API, controller, runner, Vault, edge, PPB, Task Agent, and
-  sandbox images, each with source, digest, publisher identity, SBOM,
-  provenance, and contract-test evidence;
+  sandbox images, each with source, digest, managed publisher identity, exact
+  runtime-resolved builder commit, SBOM, provenance, and contract-test evidence;
 - the canonical skills source commit and embedded-manifest digest;
 - hosted onboarding, GitHub-install, Slack-install, Vault-recovery,
   edge-routing, Task Agent, MariaDB-recovery, and rollback runs;

.github/compatibility/platform-release.owners.json

@@ -13,6 +13,7 @@
     {"path": "/platformImages/*/image/source/repository", "owner": "platform-component-owner"},
     {"path": "/platformImages/*/image/source/commit", "owner": "platform-component-owner"},
     {"path": "/platformImages/*/image/attestations/certificateIdentity", "owner": "libops-devsecops"},
+    {"path": "/platformImages/*/image/attestations/builderCommit", "owner": "libops-devsecops"},
     {"path": "/platformImages/*/image/attestations/callerWorkflowRef", "owner": "libops-devsecops"},
     {"path": "/platformImages/*/image/attestations/sbom/predicateType", "owner": "libops-devsecops"},
     {"path": "/platformImages/*/image/attestations/sbom/platforms/*", "owner": "libops-devsecops"},
@@ -55,6 +56,7 @@
     {"path": "/applications/*/images/*/source/repository", "owner": "application-family-owner"},
     {"path": "/applications/*/images/*/source/commit", "owner": "application-family-owner"},
     {"path": "/applications/*/images/*/attestations/certificateIdentity", "owner": "libops-devsecops"},
+    {"path": "/applications/*/images/*/attestations/builderCommit", "owner": "libops-devsecops"},
     {"path": "/applications/*/images/*/attestations/callerWorkflowRef", "owner": "libops-devsecops"},
     {"path": "/applications/*/images/*/attestations/sbom/predicateType", "owner": "libops-devsecops"},
     {"path": "/applications/*/images/*/attestations/sbom/platforms/*", "owner": "libops-devsecops"},

.github/compatibility/platform-release.schema.json

@@ -172,11 +172,15 @@
     "attestations": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["certificateIdentity", "callerWorkflowRef", "sbom", "provenance"],
+      "required": ["certificateIdentity", "builderCommit", "callerWorkflowRef", "sbom", "provenance"],
       "properties": {
         "certificateIdentity": {
           "type": "string",
-          "pattern": "^https://github\\.com/[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+/\\.github/workflows/build-push\\.ya?ml@[0-9a-f]{40}$"
+          "pattern": "^https://github\\.com/libops/\\.github/\\.github/workflows/build-push\\.yaml@refs/(heads|tags)/[A-Za-z0-9._/-]+$"
+        },
+        "builderCommit": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{40}$"
         },
         "callerWorkflowRef": {
           "type": "string",

ci/github/test_managed_refs.py

@@ -1,4 +1,7 @@
+import json
 import re
+import subprocess
+import tempfile
 import unittest
 from pathlib import Path
 
@@ -29,6 +32,61 @@ def test_libops_actions_and_workflows_follow_managed_channels(self) -> None:
             "record the resolved commit as generated evidence instead",
         )
 
+    def test_release_manifest_separates_managed_identity_from_exact_builder(self) -> None:
+        fixture = REPOSITORY_ROOT / "ci/github/testdata/platform-release.valid.json"
+        manifest = json.loads(fixture.read_text())
+        attestations = manifest["platformImages"][0]["image"]["attestations"]
+        self.assertEqual(
+            attestations["certificateIdentity"],
+            (
+                "https://github.com/libops/.github/.github/workflows/"
+                "build-push.yaml@refs/heads/main"
+            ),
+        )
+        self.assertRegex(attestations["builderCommit"], r"^[0-9a-f]{40}$")
+        self.assert_validator_accepts(manifest)
+
+        attestations["builderCommit"] = "refs/heads/main"
+        result = self.run_validator(manifest)
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("builderCommit must bind the exact resolved", result.stderr)
+
+    def test_release_manifest_rejects_sha_pinned_managed_certificate_identity(self) -> None:
+        fixture = REPOSITORY_ROOT / "ci/github/testdata/platform-release.valid.json"
+        manifest = json.loads(fixture.read_text())
+        manifest["platformImages"][0]["image"]["attestations"]["certificateIdentity"] = (
+            "https://github.com/libops/.github/.github/workflows/build-push.yaml@" + "1" * 40
+        )
+        result = self.run_validator(manifest)
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("must bind a managed shared-publisher ref", result.stderr)
+
+    def assert_validator_accepts(self, manifest: dict[str, object]) -> None:
+        result = self.run_validator(manifest)
+        self.assertEqual(result.returncode, 0, result.stderr)
+
+    def run_validator(self, manifest: dict[str, object]) -> subprocess.CompletedProcess[str]:
+        with tempfile.NamedTemporaryFile(mode="w", suffix=".json") as candidate:
+            json.dump(manifest, candidate)
+            candidate.flush()
+            return subprocess.run(
+                [
+                    "node",
+                    str(
+                        REPOSITORY_ROOT
+                        / ".github/actions/validate-platform-compatibility/validate.mjs"
+                    ),
+                    "--schema",
+                    str(REPOSITORY_ROOT / ".github/compatibility/platform-release.schema.json"),
+                    "--owners",
+                    str(REPOSITORY_ROOT / ".github/compatibility/platform-release.owners.json"),
+                    candidate.name,
+                ],
+                check=False,
+                capture_output=True,
+                text=True,
+            )
+
 
 if __name__ == "__main__":
     unittest.main()