fix: harden CI/CD evidence pipeline after code review

Review and fix the evidence pipeline code in docs/sbom/ that was
developed outside this repo without full context.

Critical: fix base64url JWT decoding in oidc.ts, symmetric fail-closed
policy for missing secrets data in Rego, OPA binary integrity check.

High: fix CWE-78 injection in workflow run steps (Semgrep finding),
fix compile-breaking src/ path mismatches, populate policy_version
and decision in D1 via request headers.

Medium: full observability config, nbf claim validation, robust
SARIF parsing, pin actions to SHA hashes.

Docs: align runbook with existing security.yml workflow, document
Trivy/Grype overlap and collect-scan-results bridge requirement.

Closes #7

InfoSec: fixes JWT verification bug, OPA supply chain integrity,
GH Actions injection (CWE-78), and policy logic gap for secrets

Author: RickCogley

docs/sbom/attest-and-ship.yml

@@ -0,0 +1,292 @@
+# Reusable workflow: Attestation + Evidence Shipping
+#
+# Adds to your existing shared lint/scan workflows:
+# 1. Generates SLSA provenance via GitHub's built-in attestation
+# 2. Evaluates a deterministic OPA policy against scan results
+# 3. Ships the evidence bundle to the Cloudflare evidence-sink Worker
+#
+# Usage in a calling workflow:
+#
+#   jobs:
+#     security:
+#       uses: esolia/.github/.github/workflows/security.yml@main
+#       with:
+#         package-manager: npm
+#         source-paths: src/
+#
+#     attest:
+#       needs: security
+#       uses: esolia/.github/.github/workflows/attest-and-ship.yml@main
+#       with:
+#         scan-artifact-name: scan-results   # artifact from security.yml
+#       secrets:
+#         EVIDENCE_SINK_URL: ${{ secrets.EVIDENCE_SINK_URL }}
+#
+# The upstream workflow must upload scan results as an artifact named
+# `scan-results` containing SARIF files and/or a summary JSON.
+# See the runbook for the required `collect-scan-results` bridge job.
+
+name: Attest and Ship Evidence
+
+on:
+  workflow_call:
+    inputs:
+      scan-artifact-name:
+        description: 'Name of the artifact containing scan results (SARIF, JSON)'
+        required: false
+        type: string
+        default: 'scan-results'
+      policy-version:
+        description: 'OPA policy version tag (for deterministic replay)'
+        required: false
+        type: string
+        default: 'v1'
+      skip-attestation:
+        description: 'Skip GitHub artifact attestation (for non-app repos)'
+        required: false
+        type: boolean
+        default: false
+    secrets:
+      EVIDENCE_SINK_URL:
+        description: 'URL of the Cloudflare evidence-sink Worker endpoint'
+        required: true
+
+permissions:
+  id-token: write      # GitHub OIDC token for keyless signing + Worker auth
+  contents: read
+  attestations: write  # Required for actions/attest-build-provenance
+
+jobs:
+  attest-and-ship:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      # ── Download scan results from the upstream job ──
+      - name: Download scan results
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: ${{ inputs.scan-artifact-name }}
+          path: ./scan-results
+
+      # ── Generate SLSA provenance (GitHub-native, records to Rekor) ──
+      - name: Attest build provenance
+        if: ${{ !inputs.skip-attestation }}
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: './scan-results/**'
+
+      # ── Deterministic policy evaluation ──
+      #
+      # This step is the "decision as artifact" concept from the Nono-Gate
+      # article, but using OPA/Rego — a mature, widely-adopted engine.
+      #
+      # The policy file lives in your shared .github repo so it's versioned
+      # alongside the workflow. Same inputs + same policy = same output.
+      # InfoSec: Pin OPA binary to version + SHA-256 to prevent supply chain attacks.
+      # To update: download new binary, compute sha256sum, update both values.
+      - name: Install OPA
+        env:
+          OPA_VERSION: "1.4.2"
+          # sha256sum of opa_linux_amd64_static v1.4.2
+          # Verify at: https://github.com/open-policy-agent/opa/releases/tag/v1.4.2
+          OPA_SHA256: "FIXME_REPLACE_WITH_ACTUAL_SHA256_FROM_OPA_RELEASE_PAGE"
+        run: |
+          curl -fsSL -o /usr/local/bin/opa \
+            "https://openpolicyagent.org/downloads/v${OPA_VERSION}/opa_linux_amd64_static"
+          echo "${OPA_SHA256}  /usr/local/bin/opa" | sha256sum -c -
+          chmod +x /usr/local/bin/opa
+
+      - name: Evaluate security policy
+        id: policy
+        env:
+          # InfoSec: Use env vars instead of ${{ }} interpolation in run steps
+          # to prevent injection via crafted input values (CWE-78).
+          POLICY_VERSION: ${{ inputs.policy-version }}
+        run: |
+          # Collect scan summaries into a single input document.
+          # Handles both SARIF files and a plain summary.json from your
+          # existing scan steps. Add parsers here as your scan tooling grows.
+          echo '{}' > /tmp/policy-input.json
+
+          # If a summary.json exists (your custom scan output), use it directly
+          if [[ -f ./scan-results/summary.json ]]; then
+            cp ./scan-results/summary.json /tmp/policy-input.json
+          fi
+
+          # If SARIF files exist, extract critical/high counts.
+          # Use jq's error-tolerant operators (?., //) to handle SARIF files
+          # with missing .runs or .results arrays without failing.
+          SARIF_FILES=$(find ./scan-results -name '*.sarif' -o -name '*.sarif.json' 2>/dev/null)
+          if [[ -n "$SARIF_FILES" ]]; then
+            CRITICAL=0
+            HIGH=0
+            while IFS= read -r f; do
+              [[ -f "$f" ]] || continue
+              C=$(jq '[.runs[]?.results[]? | select(.level == "error")] | length' "$f" 2>/dev/null || echo 0)
+              H=$(jq '[.runs[]?.results[]? | select(.level == "warning")] | length' "$f" 2>/dev/null || echo 0)
+              CRITICAL=$((CRITICAL + C))
+              HIGH=$((HIGH + H))
+            done <<< "$SARIF_FILES"
+
+            # Merge into policy input
+            jq --argjson c "$CRITICAL" --argjson h "$HIGH" \
+              '. + {sarif_critical: $c, sarif_high: $h}' \
+              /tmp/policy-input.json > /tmp/policy-input-merged.json
+            mv /tmp/policy-input-merged.json /tmp/policy-input.json
+          fi
+
+          # Add metadata for reproducibility
+          jq --arg repo "$GITHUB_REPOSITORY" \
+             --arg sha "$GITHUB_SHA" \
+             --arg ref "$GITHUB_REF" \
+             --arg run "$GITHUB_RUN_ID" \
+             --arg pv "$POLICY_VERSION" \
+             --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+             '. + {
+               _meta: {
+                 repo: $repo,
+                 commit_sha: $sha,
+                 ref: $ref,
+                 run_id: $run,
+                 policy_version: $pv,
+                 evaluated_at: $ts
+               }
+             }' /tmp/policy-input.json > /tmp/policy-input-final.json
+
+          # Evaluate policy
+          DECISION=$(opa eval \
+            --data ".github/policies/ci-security-${POLICY_VERSION}.rego" \
+            --input /tmp/policy-input-final.json \
+            --format json \
+            'data.esolia.ci.security' 2>&1) || true
+
+          echo "$DECISION" > /tmp/policy-decision.json
+
+          # Extract pass/fail
+          ALLOW=$(echo "$DECISION" | jq -r '.result[0].expressions[0].value.allow // false')
+          echo "allow=$ALLOW" >> "$GITHUB_OUTPUT"
+          echo "policy_version=$POLICY_VERSION" >> "$GITHUB_OUTPUT"
+          echo "Policy decision: allow=$ALLOW"
+
+      # ── Build evidence bundle ──
+      - name: Build evidence bundle
+        id: bundle
+        env:
+          POLICY_VERSION: ${{ inputs.policy-version }}
+          POLICY_ALLOW: ${{ steps.policy.outputs.allow }}
+        run: |
+          BUNDLE_DIR=/tmp/evidence-bundle
+          mkdir -p "$BUNDLE_DIR"
+
+          # Copy scan results
+          cp -r ./scan-results/* "$BUNDLE_DIR/" 2>/dev/null || true
+
+          # Copy policy input and decision
+          cp /tmp/policy-input-final.json "$BUNDLE_DIR/policy-input.json"
+          cp /tmp/policy-decision.json "$BUNDLE_DIR/policy-decision.json"
+
+          # Generate manifest with content hashes
+          MANIFEST=$(jq -n \
+            --arg schema "1.0" \
+            --arg repo "$GITHUB_REPOSITORY" \
+            --arg sha "$GITHUB_SHA" \
+            --arg ref "$GITHUB_REF" \
+            --arg run_id "$GITHUB_RUN_ID" \
+            --arg run_url "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
+            --arg actor "$GITHUB_ACTOR" \
+            --arg pv "$POLICY_VERSION" \
+            --arg allow "$POLICY_ALLOW" \
+            --arg ts "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            '{
+              schema_version: $schema,
+              report_type: "cicd_evidence",
+              repository: $repo,
+              commit_sha: $sha,
+              ref: $ref,
+              run_id: $run_id,
+              run_url: $run_url,
+              actor: $actor,
+              policy_version: $pv,
+              decision: $allow,
+              generated_at: $ts,
+              artifacts: {}
+            }')
+
+          # Hash each file in the bundle and add to manifest
+          for f in "$BUNDLE_DIR"/*; do
+            [[ -f "$f" ]] || continue
+            FNAME=$(basename "$f")
+            HASH=$(sha256sum "$f" | cut -d' ' -f1)
+            SIZE=$(stat -c%s "$f")
+            MANIFEST=$(echo "$MANIFEST" | jq \
+              --arg key "$FNAME" \
+              --arg hash "$HASH" \
+              --argjson size "$SIZE" \
+              '.artifacts[$key] = {sha256: $hash, size_bytes: $size}')
+          done
+
+          echo "$MANIFEST" | jq '.' > "$BUNDLE_DIR/manifest.json"
+
+          # Also hash the manifest itself for the shipping step
+          MANIFEST_HASH=$(sha256sum "$BUNDLE_DIR/manifest.json" | cut -d' ' -f1)
+          echo "manifest_hash=$MANIFEST_HASH" >> "$GITHUB_OUTPUT"
+
+      # ── Ship to Cloudflare evidence sink ──
+      - name: Request GitHub OIDC token
+        id: oidc
+        run: |
+          # Request a token scoped to our evidence-sink Worker
+          OIDC_TOKEN=$(curl -sS -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=esolia-cicd-evidence" | jq -r '.value')
+          echo "::add-mask::$OIDC_TOKEN"
+          echo "token=$OIDC_TOKEN" >> "$GITHUB_OUTPUT"
+
+      - name: Ship evidence bundle
+        env:
+          OIDC_TOKEN: ${{ steps.oidc.outputs.token }}
+          MANIFEST_HASH: ${{ steps.bundle.outputs.manifest_hash }}
+          EVIDENCE_SINK_URL: ${{ secrets.EVIDENCE_SINK_URL }}
+          POLICY_VERSION: ${{ steps.policy.outputs.policy_version }}
+          POLICY_ALLOW: ${{ steps.policy.outputs.allow }}
+        run: |
+          BUNDLE_DIR=/tmp/evidence-bundle
+
+          # Create a tarball of the evidence bundle
+          tar czf /tmp/evidence-bundle.tar.gz -C "$BUNDLE_DIR" .
+
+          # Ship to the evidence-sink Worker.
+          # X-Policy-Version and X-Policy-Decision headers let the Worker index
+          # these values in D1 without decompressing the tarball.
+          HTTP_STATUS=$(curl -sS -o /tmp/ship-response.json -w "%{http_code}" \
+            -X POST \
+            -H "Authorization: Bearer $OIDC_TOKEN" \
+            -H "Content-Type: application/gzip" \
+            -H "X-Evidence-Manifest-Hash: $MANIFEST_HASH" \
+            -H "X-GitHub-Repository: $GITHUB_REPOSITORY" \
+            -H "X-GitHub-Run-ID: $GITHUB_RUN_ID" \
+            -H "X-GitHub-SHA: $GITHUB_SHA" \
+            -H "X-Policy-Version: $POLICY_VERSION" \
+            -H "X-Policy-Decision: $POLICY_ALLOW" \
+            --data-binary @/tmp/evidence-bundle.tar.gz \
+            "$EVIDENCE_SINK_URL/api/v1/evidence")
+
+          echo "Response status: $HTTP_STATUS"
+          cat /tmp/ship-response.json
+
+          if [[ "$HTTP_STATUS" -ge 400 ]]; then
+            echo "::warning::Evidence shipping failed with status $HTTP_STATUS (non-blocking)"
+          fi
+
+      # ── Fail the build if policy says no ──
+      - name: Enforce policy decision
+        if: steps.policy.outputs.allow != 'true'
+        env:
+          POLICY_VERSION: ${{ inputs.policy-version }}
+        run: |
+          echo "::error::Security policy evaluation failed. Check policy-decision.json in the evidence bundle."
+          echo "::error::Run ID: $GITHUB_RUN_ID | Policy version: $POLICY_VERSION"
+          exit 1

docs/sbom/ci-security-v1.rego

@@ -0,0 +1,88 @@
+# CI Security Policy — v1
+#
+# Deterministic evaluation of security scan results.
+# Same inputs + this policy version = same decision, every time.
+#
+# This file lives at: .github/policies/ci-security-v1.rego
+# Version it alongside your workflows. When you change policy logic,
+# create ci-security-v2.rego and update the workflow input.
+#
+# To test locally:
+#   opa eval --data ci-security-v1.rego \
+#            --input test-input.json \
+#            'data.esolia.ci.security'
+
+package esolia.ci.security
+
+import rego.v1
+
+# ── Decision ──
+
+default allow := false
+
+allow if {
+    no_critical_findings
+    no_leaked_secrets
+}
+
+# ── Rules ──
+
+# Block on any critical SARIF findings
+no_critical_findings if {
+    input.sarif_critical == 0
+}
+
+# Also block if critical count is missing (scan didn't run = not safe to pass)
+no_critical_findings if {
+    not input.sarif_critical
+    input.scan_status == "skipped_not_applicable"
+}
+
+# Block if secrets were detected — or if secret scanning didn't run.
+# InfoSec: Default to fail (same as no_critical_findings) so missing scan
+# data is never silently treated as safe.
+default no_leaked_secrets := false
+
+no_leaked_secrets if {
+    input.secrets_found == 0
+}
+
+# Allow pass if secret scanning was explicitly marked as not applicable
+no_leaked_secrets if {
+    not input.secrets_found
+    input.scan_status == "skipped_not_applicable"
+}
+
+# Deny if secrets were detected
+no_leaked_secrets := false if {
+    input.secrets_found > 0
+}
+
+# ── Metadata (included in decision output for audit) ──
+
+policy_version := "v1"
+
+decision_reasons contains reason if {
+    input.sarif_critical > 0
+    reason := sprintf("blocked: %d critical SARIF findings", [input.sarif_critical])
+}
+
+decision_reasons contains reason if {
+    input.secrets_found > 0
+    reason := sprintf("blocked: %d secrets detected", [input.secrets_found])
+}
+
+decision_reasons contains reason if {
+    allow
+    reason := "all checks passed"
+}
+
+# ── Summary (the structured output consumed by the workflow) ──
+
+summary := {
+    "allow": allow,
+    "policy_version": policy_version,
+    "reasons": decision_reasons,
+    "evaluated_at": input._meta.evaluated_at,
+    "commit_sha": input._meta.commit_sha,
+}