ci: verify published release provenance

[samayer12]

Summary

• download the exact Pepr version from npm after publication with retries
• require the published tarball SHA-256 to match the release build output
• verify the GitHub attestation's repository, workflow, predicate, source ref, source commit, and hosted runner
• verify npm registry signatures and provenance for the installed release

Stack

• Base PR: this PR
• Follow-up: provenance documentation (will target this branch)

Validation

• release workflow passes Prettier validation
• git diff --check passes
• strict GitHub attestation verification succeeds against pepr@2.0.2
• npm audit signatures succeeds against an installed pepr@2.0.2 dependency tree

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.98%. Comparing base (e1bf8df) to head (7d29d5b).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3344   +/-   ##
=======================================
  Coverage   77.98%   77.98%           
=======================================
  Files          92       92           
  Lines        2548     2548           
  Branches      545      545           
=======================================
  Hits         1987     1987           
  Misses        439      439           
  Partials      122      122           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[greptile-apps]

Confidence Score: 4/5

The PR should not merge until successful provenance verification gates the remaining controller-image and UDS publication paths.

Findings

1.  Verification Does Not Gate ▶

Summary

This PR adds post-publication verification of Pepr's npm release artifact, including registry download retries, digest equality, strict GitHub attestation constraints, and npm registry signature checks.

• Downloads the exact published Pepr version and compares it with the release build digest.
• Verifies repository, workflow, predicate, source, and runner claims in the GitHub attestation.
• Audits npm registry signatures and provenance from a fresh installation.
• The verification job currently does not gate the remaining image and UDS publication paths.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  B[SLSA package build] --> A[Create GitHub attestation]
  A --> P[Publish to npm]
  P --> V[Verify published digest and provenance]
  P --> I[Publish controller images]
  P --> U[Push UDS OCI package]
  V -. currently does not gate .-> I
  V -. currently does not gate .-> U

Loading

_{Reviews (1) · Last reviewed commit: "ci: verify published release provenance"}