Goal
Make every base-cli release independently verifiable and trustworthy for security-conscious adopters.
Background
The pipeline publishes Python artifacts, but adoption at scale benefits from a machine-readable dependency inventory, build provenance, and a documented verification path.
Scope
Generate and publish an SPDX or CycloneDX SBOM; enable GitHub artifact/build attestations; record hashes and source revision; add a verification job and consumer instructions; support TestPyPI and PyPI.
Acceptance Criteria
- Each release includes an SBOM and attestation tied to source revision and artifact digest.
- CI verifies metadata before publication.
- Consumers can check hashes and attestations.
- No long-lived publish secret is introduced.
Validation
Run the release workflow through a dry-run/TestPyPI path; verify SBOM, attestation, hashes, and source mapping; document clean-room verification.
Non-Goals
Do not redesign the package API or block local development on signing infrastructure.
Project Fields
- Status: Backlog
- Priority: P1
- Area: Security
- Initiative: v1.0 Readiness
- Size: M
Ownership
Goal
Make every base-cli release independently verifiable and trustworthy for security-conscious adopters.
Background
The pipeline publishes Python artifacts, but adoption at scale benefits from a machine-readable dependency inventory, build provenance, and a documented verification path.
Scope
Generate and publish an SPDX or CycloneDX SBOM; enable GitHub artifact/build attestations; record hashes and source revision; add a verification job and consumer instructions; support TestPyPI and PyPI.
Acceptance Criteria
Validation
Run the release workflow through a dry-run/TestPyPI path; verify SBOM, attestation, hashes, and source mapping; document clean-room verification.
Non-Goals
Do not redesign the package API or block local development on signing infrastructure.
Project Fields
Ownership