From f62925b74358af78247e63d6cbefebd3bca4923f Mon Sep 17 00:00:00 2001
From: Tony Meyer <tony.meyer@canonical.com>
Date: Wed, 8 Jul 2026 15:37:54 +1200
Subject: [PATCH 1/2] ci: attest provenance/SBOM and Grype-scan the built rock
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a new `attest-and-scan` job between test and upload-ghcr in the
tag-triggered publish pipeline:

- Syft (anchore/sbom-action) generates an SPDX SBOM from the OCI
  archive produced by oci-factory Build-Rock.
- actions/attest emits a signed SLSA build-provenance attestation for
  the rock (auto-generated predicate — provenance mode).
- actions/attest emits a signed SBOM attestation with the SPDX
  predicate against the same rock subject.
- Grype (anchore/scan-action) scans the SBOM and fails the build on
  vulnerabilities of severity high or above.

Notes:

- Uses actions/attest@v4 directly rather than the attest-build-provenance
  wrapper — per the v4 release note, new implementations should use
  actions/attest. Provenance and SBOM attestations are two invocations
  of the same action distinguished by mode auto-detection (no predicate
  inputs → provenance; sbom-path → SBOM).
- upload-ghcr now depends on attest-and-scan, so a rock that fails
  scanning is not pushed to GHCR and no attestations are orphaned.
- The corresponding CRA allowlist entries (`anchore/sbom-action@*`,
  `anchore/scan-action@*`) ride on the api_demo_server per-repo hunk
  in canonical/canonical-repo-automation#952. `actions/attest` is
  covered by the github-owned flag.
- Grype's check name will be added to api_demo_server's required
  status checks in CRA once this workflow is green on master.
---
 .github/workflows/publish.yaml | 47 +++++++++++++++++++++++++++++++++-
 1 file changed, 46 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 46f9338..9862c3b 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -60,9 +60,54 @@ jobs:
     with:
       oci-archive-name: ${{ matrix.artifact-name }}
 
-  upload-ghcr:
+  attest-and-scan:
     needs: [prepare, test]
     runs-on: ubuntu-latest
+    strategy:
+      matrix: ${{ fromJSON(needs.prepare.outputs.build-matrix) }}
+      fail-fast: false
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    steps:
+      - name: Download rock artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          name: ${{ matrix.artifact-name }}
+          path: ./rock
+
+      - name: Generate SBOM (Syft)
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610  # v0.24.0
+        with:
+          image: oci-archive:./rock/${{ matrix.artifact-name }}
+          format: spdx-json
+          output-file: ./sbom.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Attest build provenance
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
+        with:
+          subject-path: ./rock/${{ matrix.artifact-name }}
+
+      - name: Attest SBOM
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763  # v4.1.1
+        with:
+          subject-path: ./rock/${{ matrix.artifact-name }}
+          sbom-path: ./sbom.spdx.json
+
+      - name: Scan rock (Grype)
+        uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2  # v7.4.0
+        with:
+          sbom: ./sbom.spdx.json
+          fail-build: true
+          severity-cutoff: high
+
+  upload-ghcr:
+    needs: [prepare, attest-and-scan]
+    runs-on: ubuntu-latest
     strategy:
       matrix: ${{ fromJSON(needs.prepare.outputs.build-matrix) }}
       fail-fast: false

From b52099c3d601844dda7a26e1989172cec138202b Mon Sep 17 00:00:00 2001
From: Tony Meyer <tony.meyer@canonical.com>
Date: Tue, 14 Jul 2026 19:52:02 +1200
Subject: [PATCH 2/2] chore: bump version to 2.1.1

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 pyproject.toml | 2 +-
 rockcraft.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 31a3db4..96aa96c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "api_demo_server"
-version = "2.1.0"
+version = "2.1.1"
 description = "FastAPI demo server"
 authors = [
     { name = "The Charm Tech team at Canonical Ltd." },
diff --git a/rockcraft.yaml b/rockcraft.yaml
index 8fba609..35d0907 100644
--- a/rockcraft.yaml
+++ b/rockcraft.yaml
@@ -2,7 +2,7 @@ name: api-demo-server
 base: bare
 build-base: ubuntu@24.04
 run-user: _daemon_
-version: "2.1.0"
+version: "2.1.1"
 summary: FastAPI demo server
 description: A web server that can be integrated with a PostgreSQL database.
 license: Apache-2.0