fix(release): bind publishable artifacts to source provenance

.github/workflows/release.yml

@@ -208,9 +208,52 @@ jobs:
             safe-change-sbom.cdx.json
           if-no-files-found: error
 
+  bind-artifacts:
+    name: Bind Exact Release Artifacts
+    needs: [build-native, build-root]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.2.0
+        with:
+          node-version: 20.x
+
+      - name: Download native binaries
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          pattern: native-binary-*
+          path: artifacts
+
+      - name: Download root package and SBOM
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: root-package-tarball
+          path: root-artifacts
+
+      - name: Download release self-evidence
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: release-evidence-bundle
+          path: root-artifacts
+
+      - name: Bind package metadata, source SHA, and artifact digests
+        run: node scripts/publish-orchestrator.mjs --phase prepare
+
+      - name: Upload bound release artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: bound-release-artifacts
+          path: release-bound
+          if-no-files-found: error
+
   publish-native:
     name: Publish Native Platform Packages
-    needs: [preflight, build-native]
+    needs: [preflight, bind-artifacts]
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
     environment: npm-production
@@ -226,10 +269,14 @@ jobs:
           node-version: 20.x
           registry-url: "https://registry.npmjs.org"
 
-      - name: Download all native artifacts
+      - name: Download bound release artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
-          path: artifacts
+          name: bound-release-artifacts
+          path: release-bound
+
+      - name: Verify bound artifact manifest before native publication
+        run: node scripts/publish-orchestrator.mjs --dry-run --phase native
 
       - name: Orchestrate exact native tarball publication
         run: node scripts/publish-orchestrator.mjs --phase native
@@ -238,7 +285,7 @@ jobs:
 
   publish-root:
     name: Publish Root safe-change Package
-    needs: [preflight, build-root, publish-native]
+    needs: [preflight, bind-artifacts, publish-native]
     runs-on: ubuntu-latest
     if: github.event_name == 'push' && github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
     environment: npm-production
@@ -257,20 +304,14 @@ jobs:
           node-version: 20.x
           registry-url: "https://registry.npmjs.org"
 
-      - name: Download root tarball artifact
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: root-package-tarball
-          path: .
-
-      - name: Download verified release self-evidence
+      - name: Download bound release artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
-          name: release-evidence-bundle
-          path: .
+          name: bound-release-artifacts
+          path: release-bound
 
-      - name: Verify self-evidence archive checksum
-        run: sha256sum -c release-evidence.tar.gz.sha256
+      - name: Verify bound artifact manifest before root publication
+        run: node scripts/publish-orchestrator.mjs --dry-run --phase root
 
       - name: Publish exact verified root tarball
         run: node scripts/publish-orchestrator.mjs --phase root
@@ -287,19 +328,19 @@ jobs:
           if [[ "$RELEASE_TAG" == *-* ]]; then
             gh release create "$RELEASE_TAG" --prerelease --latest=false \
               --title "$RELEASE_TAG — Experimental Developer Preview" \
-              --generate-notes safe-change-*.tgz safe-change-sbom.cdx.json safe-change-audit-anchor.json release-evidence.tar.gz release-evidence.tar.gz.sha256
+              --generate-notes release-bound/*.tgz release-bound/safe-change-sbom.cdx.json safe-change-audit-anchor.json release-bound/release-evidence.tar.gz release-bound/release-evidence.tar.gz.sha256 release-bound/release-artifact-manifest.json release-bound/release-artifact-manifest.json.sha256
           else
             gh release create "$RELEASE_TAG" \
               --title "$RELEASE_TAG" \
-              --generate-notes safe-change-*.tgz safe-change-sbom.cdx.json safe-change-audit-anchor.json release-evidence.tar.gz release-evidence.tar.gz.sha256
+              --generate-notes release-bound/*.tgz release-bound/safe-change-sbom.cdx.json safe-change-audit-anchor.json release-bound/release-evidence.tar.gz release-bound/release-evidence.tar.gz.sha256 release-bound/release-artifact-manifest.json release-bound/release-artifact-manifest.json.sha256
           fi
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           RELEASE_TAG: ${{ github.ref_name }}
 
   dry-run-artifacts:
     name: Verify Exact Release Artifacts (Dry Run)
-    needs: [build-native, build-root]
+    needs: bind-artifacts
     if: github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
     steps:
@@ -314,26 +355,11 @@ jobs:
           node-version: 20.x
           registry-url: "https://registry.npmjs.org"
 
-      - name: Download native artifacts
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          pattern: native-binary-*
-          path: artifacts
-
-      - name: Download root tarball artifact
+      - name: Download bound release artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
-          name: root-package-tarball
-          path: .
-
-      - name: Download verified release self-evidence
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
-        with:
-          name: release-evidence-bundle
-          path: .
-
-      - name: Verify self-evidence archive checksum
-        run: sha256sum -c release-evidence.tar.gz.sha256
+          name: bound-release-artifacts
+          path: release-bound
 
       - name: Verify exact native and root artifacts without publishing
         run: node scripts/publish-orchestrator.mjs --dry-run