package-publishing

Every shipped artifact carries: CycloneDX SBOM, cosign keyless signature, SLSA v1.0 build L2 provenance. Implemented via the dunn.dev/pipeline catalog templates that already exist for Go, Rust, Node, and container images.

The unifying rule: if a repo publishes a package (Go binary, npm tarball, Rust crate, container image), it includes the corresponding catalog templates so each release ships with provenance artifacts that consumers can verify.

What this standard checks

Generated from ./check.sh, in the order the check runs them.

assertion	target	pattern or value	note
applies at all, or stops the run	`.gitlab-ci.yml:gitlab\.com/dunn\.dev/pipeline/(node-publish\|rust-crates-publish\|go-release-binary\|rust-release-binary\|container-image)@` or `.gitlab-ci.yml:(npm\|pnpm\|yarn) publish\|cargo publish\|goreleaser\|twine upload` or `package.json:publishConfig`		a repo that publishes no artifact has nothing to attest or release, and a waiver per assertion would read as an unmet obligation rather than an absent one; governs repos that publish a package, a binary or an image
file matches	`.gitlab-ci.yml`	`^[^#]*gitlab\.com/dunn\.dev/pipeline/slsa-attest@[0-9]+(\.[0-9]+){0,2}([^0-9A-Za-z.-]\|$)`	an artifact with no attestation cannot be traced back to the pipeline that built it
file matches	`.gitlab-ci.yml`	`^[^#]*gitlab\.com/dunn\.dev/pipeline/release-create@[0-9]+(\.[0-9]+){0,2}([^0-9A-Za-z.-]\|$)`	a tag with no release page leaves consumers nowhere to read install instructions

Per-language composition

Go CLI:

include:
  - component: gitlab.com/dunn.dev/pipeline/go-release-binary@X.Y.Z
  - component: gitlab.com/dunn.dev/pipeline/go-sbom@X.Y.Z
  - component: gitlab.com/dunn.dev/pipeline/slsa-attest@X.Y.Z
  - component: gitlab.com/dunn.dev/pipeline/release-create@X.Y.Z

Rust CLI:

include:
  - component: gitlab.com/dunn.dev/pipeline/rust-release-binary@X.Y.Z
  - component: gitlab.com/dunn.dev/pipeline/rust-sbom@X.Y.Z
  - component: gitlab.com/dunn.dev/pipeline/slsa-attest@X.Y.Z
  - component: gitlab.com/dunn.dev/pipeline/release-create@X.Y.Z

A crate published to crates.io adds one component alongside the block above, no inputs needed:

  - component: gitlab.com/dunn.dev/pipeline/rust-crates-publish@X.Y.Z

Node package:

include:
  - component: gitlab.com/dunn.dev/pipeline/node-publish@X.Y.Z
  - component: gitlab.com/dunn.dev/pipeline/node-sbom@X.Y.Z
  - component: gitlab.com/dunn.dev/pipeline/slsa-attest@X.Y.Z
    inputs:
      binary_job: node-publish
  - component: gitlab.com/dunn.dev/pipeline/release-create@X.Y.Z

Container image (no separate binary):

include:
  - component: gitlab.com/dunn.dev/pipeline/container-image@X.Y.Z
    inputs:
      image_tag: app
      tag_pipeline: true
  - component: gitlab.com/dunn.dev/pipeline/container-sbom@X.Y.Z
    inputs:
      container_image: "${CI_REGISTRY_IMAGE}/app:${CI_COMMIT_TAG}"
      package_name: app
  - component: gitlab.com/dunn.dev/pipeline/slsa-attest@X.Y.Z
    inputs:
      binary_job: build-image
  - component: gitlab.com/dunn.dev/pipeline/release-create@X.Y.Z
    inputs:
      package_name: app
      binary_job: build-image

How to satisfy

Add the per-language block above to .gitlab-ci.yml, in the canonical include: - component: gitlab.com/dunn.dev/pipeline/<name>@X.Y.Z shape: the publish or release component for the artifact, plus slsa-attest and release-create alongside it. The two universals are what this standard asserts; the per-language SBOM component travels with them.

Deviations

A deviation is for a repo that does publish and does not meet one; a repo that publishes nothing (documentation-only, config-only, the catalogs themselves) reports N/A instead.