|
260301
|
Run https://github.com/actions/checkout@v4
|
38287
|
1
|
116
|
4
|
0
|
0
|
0
|
0
|
1793734765
|
1793734766
|
Edit
Delete
|
|
260302
|
Enable pnpm
|
38287
|
2
|
116
|
4
|
0
|
0
|
0
|
0
|
1793734765
|
1793734766
|
Edit
Delete
|
|
260303
|
Run https://github.com/actions/setup-node@v4
|
38287
|
3
|
116
|
4
|
0
|
0
|
0
|
0
|
1793734765
|
1793734766
|
Edit
Delete
|
|
260304
|
Private registry auth (temporary userconfig)
|
38287
|
4
|
116
|
4
|
0
|
0
|
0
|
0
|
1793734765
|
1793734766
|
Edit
Delete
|
|
260305
|
Install locked governance tools
|
38287
|
5
|
116
|
4
|
0
|
0
|
0
|
0
|
1793734765
|
1793734766
|
Edit
Delete
|
|
260306
|
Resolve npmrc for BuildKit secret (never printed)
|
38287
|
6
|
116
|
4
|
0
|
0
|
0
|
0
|
1793734765
|
1793734766
|
Edit
Delete
|
|
260307
|
Build runtime image from git archive HEAD:runtime Build runtime image from git archive HEAD:runtime (reports/image-digest.json)...
|
38287
|
7
|
116
|
4
|
0
|
0
|
0
|
0
|
1793734765
|
1793734766
|
Edit
Delete
|
|
260308
|
Install syft (pinned) and generate SPDX SBOM
|
38287
|
8
|
116
|
4
|
0
|
0
|
0
|
0
|
1793734765
|
1793734766
|
Edit
Delete
|
|
260309
|
Install cosign (pinned)
|
38287
|
9
|
116
|
4
|
0
|
0
|
0
|
0
|
1793734765
|
1793734766
|
Edit
Delete
|
|
260310
|
Sign image when COSIGN_PRIVATE_KEY is provided (ot Sign image when COSIGN_PRIVATE_KEY is provided (otherwise explicit skip)...
|
38287
|
10
|
116
|
4
|
0
|
0
|
0
|
0
|
1793734765
|
1793734766
|
Edit
Delete
|
|
260311
|
Upload image evidence
|
38287
|
11
|
116
|
4
|
0
|
0
|
0
|
0
|
1793734765
|
1793734766
|
Edit
Delete
|
|
260312
|
Candidate tag (real run attempt, computed per job)
|
38288
|
0
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260313
|
Run https://github.com/actions/checkout@v4
|
38288
|
1
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260314
|
Enable pnpm
|
38288
|
2
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260315
|
Run https://github.com/actions/setup-node@v4
|
38288
|
3
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260316
|
Download static evidence
|
38288
|
4
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260317
|
Download runtime evidence
|
38288
|
5
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260318
|
Download identity evidence
|
38288
|
6
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260319
|
Download port-conformance evidence
|
38288
|
7
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260320
|
Verify candidate (per-report sourceSha / dirty / s Verify candidate (per-report sourceSha / dirty / status / digest; missing → ineligible)...
|
38288
|
8
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260321
|
Download image and full SBOM evidence for the same Download image and full SBOM evidence for the same candidate...
|
38288
|
9
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260322
|
Release Manifest (known facts, status partial unti Release Manifest (known facts, status partial until all deliverables exist)...
|
38288
|
10
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260323
|
Upload candidate evidence
|
38288
|
11
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260324
|
Propagate upstream results and candidate eligibili Propagate upstream results and candidate eligibility...
|
38288
|
12
|
116
|
3
|
0
|
0
|
0
|
0
|
1793734767
|
1793734798
|
Edit
Delete
|
|
260325
|
Candidate tag (real run attempt, computed per job)
|
38289
|
0
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260326
|
Run https://github.com/actions/checkout@v4
|
38289
|
1
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260327
|
Enable pnpm
|
38289
|
2
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260328
|
Run https://github.com/actions/setup-node@v4
|
38289
|
3
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260329
|
Private registry auth (temporary userconfig)
|
38289
|
4
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260330
|
Install locked governance tools
|
38289
|
5
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260331
|
Test image release credential preflight (synthetic Test image release credential preflight (synthetic credentials only)...
|
38289
|
6
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260332
|
Install contracts dependencies (public npm only, f Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)...
|
38289
|
7
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260333
|
Install dictionary service dependencies (independe Install dictionary service dependencies (independent frozen lockfile)...
|
38289
|
8
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260334
|
Governance checks (exact engineering package; publ Governance checks (exact engineering package; public contracts dependencies)...
|
38289
|
9
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260335
|
Pack publishable packages (contracts + governance; Pack publishable packages (contracts + governance; no publish)...
|
38289
|
10
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260336
|
Upload package tarballs
|
38289
|
11
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260337
|
Upload public static evidence
|
38289
|
12
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736316
|
1793736407
|
Edit
Delete
|
|
260338
|
Candidate tag (real run attempt, computed per job)
|
38290
|
0
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|
|
260339
|
Run https://github.com/actions/checkout@v4
|
38290
|
1
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|
|
260340
|
Enable pnpm
|
38290
|
2
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|
|
260341
|
Run https://github.com/actions/setup-node@v4
|
38290
|
3
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|
|
260342
|
Private registry auth (temporary userconfig)
|
38290
|
4
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|
|
260343
|
Install locked governance tools
|
38290
|
5
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|
|
260344
|
Install runtime workspace (frozen lockfile)
|
38290
|
6
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|
|
260345
|
Install contracts dependencies (public npm only, f Install contracts dependencies (public npm only, frozen lockfile; CT-1 build / validators / generated-types check)...
|
38290
|
7
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|
|
260346
|
Install dictionary service dependencies (independe Install dictionary service dependencies (independent frozen lockfile)...
|
38290
|
8
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|
|
260347
|
Generate Prisma clients
|
38290
|
9
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|
|
260348
|
Build runtime modules (fixture suites evaluate mig Build runtime modules (fixture suites evaluate migrated rules from dist)...
|
38290
|
10
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|
|
260349
|
Repo-root governance gate
|
38290
|
11
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|
|
260350
|
Source tree must stay clean apart from latest repo Source tree must stay clean apart from latest reports (no tracked .npmrc mutation)...
|
38290
|
12
|
116
|
3
|
0
|
0
|
0
|
0
|
1793736407
|
1793736576
|
Edit
Delete
|