Supply Chain #117
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ============================================================================= | |
| # SpatialSync — Supply Chain Security | |
| # 2026 Industry Standard: Full supply chain observability | |
| # ============================================================================= | |
| name: Supply Chain | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Daily dependency health check | |
| - cron: '0 6 * * *' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| PHP_VERSION: '8.3' | |
| NODE_VERSION: '20' | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # 1. Lockfile Verification | |
| # --------------------------------------------------------------------------- | |
| lockfile-verification: | |
| name: 🔒 Lockfile Integrity | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Verify composer.lock is in sync | |
| run: | | |
| if [ ! -f "composer.lock" ]; then | |
| echo "::error::composer.lock is missing! Always commit lockfiles." | |
| exit 1 | |
| fi | |
| composer validate --strict --no-check-all --ansi | |
| - name: Verify package-lock.json is in sync | |
| run: | | |
| if [ ! -f "package-lock.json" ]; then | |
| echo "::error::package-lock.json is missing! Always commit lockfiles." | |
| exit 1 | |
| fi | |
| npm ls 2>/dev/null || echo "⚠️ npm dependency tree has issues" | |
| # --------------------------------------------------------------------------- | |
| # 2. Dependency Review | |
| # --------------------------------------------------------------------------- | |
| dependency-review: | |
| name: 📦 Dependency Review | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| if: github.event_name == 'pull_request' | |
| permissions: | |
| pull-requests: write | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: high | |
| comment-summary-in-pr: true | |
| deny-licenses: GPL-3.0, AGPL-3.0, AGPL-1.0 | |
| allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense, CC0-1.0 | |
| # --------------------------------------------------------------------------- | |
| # 3. SBOM Generation | |
| # --------------------------------------------------------------------------- | |
| sbom: | |
| name: 📋 SBOM Generation | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| if: github.ref == 'refs/heads/main' && github.event_name == 'push' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'npm' | |
| cache-dependency-path: package-lock.json | |
| - name: Install dependencies | |
| run: npm ci --no-audit --no-fund | |
| - name: Generate SBOM (Node) | |
| run: | | |
| npx @cyclonedx/bom@latest --output node-sbom.json || echo "::warning::Could not generate Node SBOM" | |
| - name: Upload SBOM | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sbom | |
| path: | | |
| node-sbom.json | |
| retention-days: 90 | |
| - name: Attest SBOM (optional — requires GitHub token with sigstore) | |
| run: | | |
| echo "✅ SBOM generated for release tracking" | |
| echo "To verify supply chain: gh attestation verify sbom.json" | |
| # --------------------------------------------------------------------------- | |
| # 4. Fresh Dependency Install Test | |
| # --------------------------------------------------------------------------- | |
| fresh-install: | |
| name: 🧪 Fresh Install Test | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup PHP | |
| uses: shivammathur/setup-php@v2 | |
| with: | |
| php-version: ${{ env.PHP_VERSION }} | |
| extensions: mbstring, bcmath, gd, zip, pdo_pgsql, pgsql | |
| tools: composer:v2 | |
| coverage: none | |
| - name: Create .env for CI | |
| run: cp .env.example .env | |
| - name: Fresh PHP install from lockfile | |
| run: | | |
| rm -rf vendor | |
| composer install --no-interaction --prefer-dist --no-progress --no-scripts | |
| php -r "file_put_contents('.env', preg_replace('/^APP_KEY=.*/m', 'APP_KEY=base64:' . base64_encode(random_bytes(32)), file_get_contents('.env')));" | |
| echo "✅ Fresh install successful" | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'npm' | |
| cache-dependency-path: package-lock.json | |
| - name: Fresh Node install from lockfile | |
| run: | | |
| rm -rf node_modules package-lock.json | |
| npm install | |
| echo "✅ Fresh npm install successful" |