feat(ci): add artifact receipt source contract

scripts/ci/tests/test_generate_cicd_artifact_receipts.py

@@ -0,0 +1,99 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import subprocess
+import sys
+
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+SCRIPT = REPO_ROOT / "scripts" / "ci" / "generate-cicd-artifact-receipts.py"
+
+
+def _write(path: Path, text: str) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(text, encoding="utf-8")
+
+
+def test_generate_cicd_artifact_receipts_writes_metadata_only_outputs(
+    tmp_path: Path,
+) -> None:
+    repo = tmp_path / "repo"
+    out_dir = tmp_path / "artifacts"
+    _write(
+        repo / "apps/api/pyproject.toml",
+        """
+[project]
+name = "awoooi-api"
+version = "1.2.3"
+dependencies = ["fastapi>=0.1", "asyncpg>=0.29"]
+
+[project.optional-dependencies]
+dev = ["pytest>=8"]
+""".strip(),
+    )
+    _write(
+        repo / "package.json",
+        json.dumps(
+            {
+                "name": "@awoooi/root",
+                "version": "4.5.6",
+                "dependencies": {"typescript": "^5.0.0"},
+                "devDependencies": {"eslint": "^9.0.0"},
+            }
+        ),
+    )
+    _write(repo / "pnpm-lock.yaml", "lockfileVersion: '9.0'\n")
+    _write(repo / ".gitea/workflows/cd.yaml", "name: CD\n")
+    _write(repo / "apps/api/Dockerfile", "FROM python:3.11-slim\n")
+
+    result = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT),
+            "--repo-root",
+            str(repo),
+            "--out-dir",
+            str(out_dir),
+        ],
+        check=True,
+        text=True,
+        capture_output=True,
+    )
+
+    assert "cicd_artifact_receipt_manifest_sha256=" in result.stdout
+    manifest = json.loads(
+        (out_dir / "awoooi-ci-artifact-receipts.manifest.json").read_text(
+            encoding="utf-8"
+        )
+    )
+    sbom = json.loads((out_dir / "awoooi-ci-sbom.json").read_text(encoding="utf-8"))
+    provenance = json.loads(
+        (out_dir / "awoooi-ci-provenance.json").read_text(encoding="utf-8")
+    )
+    retention = json.loads(
+        (out_dir / "awoooi-ci-artifact-retention-manifest.json").read_text(
+            encoding="utf-8"
+        )
+    )
+
+    assert manifest["schema_version"] == "awoooi_cicd_artifact_receipts_v1"
+    assert manifest["ready"] is True
+    assert manifest["operation_boundaries"] == {
+        "secret_values_collected": False,
+        "github_api_used": False,
+        "gitea_api_write_performed": False,
+        "host_write_performed": False,
+    }
+    assert sbom["schema_version"] == "awoooi_cicd_sbom_v1"
+    assert sbom["component_count"] >= 5
+    assert sbom["operation_boundaries"]["secret_value_read_allowed"] is False
+    assert provenance["schema_version"] == "awoooi_cicd_provenance_v1"
+    assert provenance["slsa_source_contract"]["provenance_receipt_generated"] is True
+    assert retention["schema_version"] == "awoooi_cicd_artifact_retention_v1"
+    assert retention["cache_key_contract"]["python_deps_hash_input"] == (
+        "apps/api/pyproject.toml"
+    )
+    assert (
+        retention["operation_boundaries"]["package_registry_write_attempted"] is False
+    )