validate.yml

name: Validate Web Console

on:
  workflow_dispatch:
    inputs:
      validation_scope:
        description: Validation scope (required CodeQL checks are separate)
        type: choice
        options: [full, dependency-security, host-disk, sbom]
        default: full

permissions:
  contents: read
  id-token: write
  attestations: write
  artifact-metadata: write

jobs:
  validate:
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    steps:
      - name: Check out immutable Web Console source
        env:
          SOURCE_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail
          git init .
          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
          git fetch --depth=1 origin "$SOURCE_SHA"
          git -c advice.detachedHead=false checkout --detach FETCH_HEAD
          test "$(git rev-parse HEAD)" = "$SOURCE_SHA"
          test -z "$(git status --short)"

      - name: Install pinned Python verifier
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: '3.14.9'
          check-latest: false

      - name: Verify Python packaging and CA tools
        run: |
          set -euo pipefail
          bash scripts/setup-ci-python-tools

      - name: Capture actual host OS and Ruby build-environment evidence
        run: |
          set -euo pipefail
          python scripts/capture-ui-builder-inventory.py "$RUNNER_TEMP/builder-host-inventory.json"

      - name: Install pinned Node.js for host-side tests
        if: ${{ inputs.validation_scope != 'sbom' }}
        env:
          NODE_VERSION: 24.22.1
          NODE_ARCHIVE_SHA256: 6c172a9ab6718f7b801fb5a7bd486af2ee5e32758086a04b84fcce2aa77095e6
          NPM_VERSION: 12.0.2
        run: |
          set -euo pipefail
          archive="$RUNNER_TEMP/node.tar.xz"
          curl \
            --proto '=https' \
            --tlsv1.2 \
            --fail \
            --silent \
            --show-error \
            --location \
            --retry 5 \
            --retry-all-errors \
            --retry-delay 2 \
            -o "$archive" \
            "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.xz"
          printf '%s  %s\n' "$NODE_ARCHIVE_SHA256" "$archive" |
            sha256sum --check
          mkdir -p "$RUNNER_TEMP/node"
          tar -xJf "$archive" --strip-components=1 -C "$RUNNER_TEMP/node"
          "$RUNNER_TEMP/node/bin/npm" install \
            --global \
            --prefix "$RUNNER_TEMP/node" \
            --ignore-scripts \
            --no-audit \
            --no-fund \
            "npm@${NPM_VERSION}"
          test "$("$RUNNER_TEMP/node/bin/npm" --version)" = "$NPM_VERSION"
          echo "$RUNNER_TEMP/node/bin" >>"$GITHUB_PATH"

      - name: Test and build twice in the isolated release producer
        id: build
        env:
          PASTURESTACK_NODE24_IMAGE: node:24.22.1-bookworm@sha256:6449e19d8184d84062525b6a7524def03146c2cb04a7f08b076680d0e8e4240a
          VALIDATION_SCOPE: ${{ inputs.validation_scope }}
        run: |
          set -euo pipefail
          python -B scripts/test-ui-builder-boundary.py
          if [[ "$VALIDATION_SCOPE" != sbom ]]; then
            test "$(node --version)" = v24.22.1
            test "$(npm --version)" = 12.0.2
            npm ci --ignore-scripts --no-audit --no-fund
            if [[ "$VALIDATION_SCOPE" = dependency-security || "$VALIDATION_SCOPE" = host-disk ]]; then
              bash scripts/check-ui-critical-high-dependencies
              node --test scripts/check-ui-handlebars-security.js scripts/test-ui-npm-audit.js scripts/test-ui-build-module-boundary.js
              node scripts/check-ui-npm-audit.js
              test_filter='legacy context partial'
              if [[ "$VALIDATION_SCOPE" = host-disk ]]; then
                test_filter='Unit | Model | host'
              fi
              CHROME_BIN=$(command -v google-chrome) ./node_modules/.bin/ember test \
                --ssl=false --host 127.0.0.1 --config-file testem.js --filter "$test_filter"
            else
              bash scripts/ci
            fi
          fi

          package_version=$(python -c 'import json; print(json.load(open("package.json"))["version"])')
          export SOURCE_DATE_EPOCH=$(git show -s --format=%ct "$GITHUB_SHA")
          producer_output=$(mktemp -d "$RUNNER_TEMP/web-console-producer.XXXXXX")
          [[ "$producer_output" = "$RUNNER_TEMP"/web-console-producer.* ]]
          trap 'rm -rf "$producer_output"' EXIT
          bash scripts/build-ui-release-candidate "$producer_output"
          for asset in \
            "web-console-${package_version}.tar.gz" \
            "web-console-${package_version}.tar.gz.sha256" \
            "web-console-${package_version}-runtime.cdx.json" \
            "web-console-${package_version}-build.cdx.json" \
            "web-console-${package_version}-artifact-manifest.json" \
            "web-console-${package_version}-sbom.sha256" \
            browser-webpack-modules.json browser-concat-stats.tar.gz \
            builder-brotli-security.json \
            builder-container-inventory-before.json builder-container-inventory-after.json; do
            test -s "$producer_output/$asset"
            cp "$producer_output/$asset" "$RUNNER_TEMP/$asset"
          done
          release_asset="$RUNNER_TEMP/web-console-${package_version}.tar.gz"
          printf 'package_version=%s\nrelease_asset=%s\n' \
            "$package_version" "$release_asset" >>"$GITHUB_OUTPUT"

      - name: Attest original static archive provenance
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: ${{ steps.build.outputs.release_asset }}

      - name: Attest browser runtime SBOM against original static archive
        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: ${{ steps.build.outputs.release_asset }}
          sbom-path: ${{ runner.temp }}/web-console-${{ steps.build.outputs.package_version }}-runtime.cdx.json

      - name: Retain reviewed candidate for release
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: web-console-${{ steps.build.outputs.package_version }}
          path: |
            ${{ steps.build.outputs.release_asset }}
            ${{ steps.build.outputs.release_asset }}.sha256
            ${{ runner.temp }}/web-console-${{ steps.build.outputs.package_version }}-runtime.cdx.json
            ${{ runner.temp }}/web-console-${{ steps.build.outputs.package_version }}-build.cdx.json
            ${{ runner.temp }}/web-console-${{ steps.build.outputs.package_version }}-artifact-manifest.json
            ${{ runner.temp }}/web-console-${{ steps.build.outputs.package_version }}-sbom.sha256
            ${{ runner.temp }}/builder-host-inventory.json
            ${{ runner.temp }}/builder-brotli-security.json
            ${{ runner.temp }}/builder-container-inventory-before.json
            ${{ runner.temp }}/builder-container-inventory-after.json
            ${{ runner.temp }}/browser-webpack-modules.json
            ${{ runner.temp }}/browser-concat-stats.tar.gz
          if-no-files-found: error
          retention-days: 30
          compression-level: 0