fix(release): repair the release pipeline and sign released artifacts

Release-pipeline fixes:
- Attach the DI container on the early-dispatch path so 'orb init' /
  'orb templates generate' work on a fresh checkout (they raised
  AttributeError before), unblocking the OpenAPI-export release step.
- 'all' extra now includes the web UI + monitoring-aws, so
  'pip install orb-py[all]' and the published container are fully functional.
  The production and dev container images build the SPA (Setup Bun) and install
  '[all]'; the release install syncs '--extra all --no-dev'.  A unit test guards
  that 'all' keeps covering every runtime extra.  The container HEALTHCHECK
  probes /orb/health to match the embedded-UI mount point.
- SBOM generation is non-blocking and emits CycloneDX + plain + SPDX; all three
  ship as release assets.  The OpenAPI-export readiness check polls the served
  endpoint and fails explicitly if the server never becomes ready.
- Manual workflow_dispatch cannot publish to production: the wheel-publish,
  container build/push/sign, manifest, and asset jobs are all gated to
  'release' events, so a manual run can't push dev-versioned images or move
  the 'latest' tag.
- Serial-provider junit/coverage filenames match the Codecov upload pattern.

Signing & provenance:
- Release assets (wheel + sdist) carry a single Sigstore build-provenance
  attestation, produced in one place over the exact published wheel, uploaded
  alongside the release.
- Container images are cosign-signed (keyless) with SLSA build provenance +
  SBOM attestations (per-image and manifest lists); images are vulnerability-
  scanned with a blocking gate (build --load, Trivy exit-1 on CRITICAL/HIGH)
  before push on the default Python, advisory on the rest.
- PyPI publishing keeps its PEP 740 attestations.

Author: fgogolli

.github/workflows/dev-containers.yml

@@ -103,6 +103,10 @@ jobs:
       contents: read
       packages: write
       security-events: write
+      # Required for keyless cosign signing (ambient OIDC token) and
+      # actions/attest-build-provenance on pushed images.
+      id-token: write
+      attestations: write
 
     steps:
     - name: Checkout code
@@ -126,14 +130,23 @@ jobs:
         cache-key: ${{ needs.setup-cache.outputs.cache-key }}
         fail-on-cache-miss: false
 
+    - name: Setup Bun (for UI static bundle)
+      # Bun is required to compile the Reflex SPA bundle during `make build`.
+      # Without it the wheel ships no _static/ directory and the container starts
+      # in embedded mode with a missing SPA — a non-bootable signed image (H2).
+      # This mirrors the prod-release.yml build-wheel pattern for prod/dev parity.
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6  # v2
+      with:
+        bun-version: "1.2.15"  # pinned; update intentionally to avoid surprise breakage
+
     - name: Build package wheel
-      # This job builds a wheel to scan in a container image and has no bun/uv
-      # to compile the SPA (it never shipped one).  Skip the UI build.
-      env:
-        ORB_SKIP_UI_BUILD: "1"
+      # SPA bundle is compiled by the setuptools build hook during `make build`
+      # now that Bun is on PATH.  ORB_SKIP_UI_BUILD is NOT set so the wheel
+      # ships the _static/ directory — identical to the prod-release.yml wheel.
       run: make build
 
     - name: Build and scan container image
+      id: build
       shell: bash
       env:
         REGISTRY: ${{ needs.config.outputs.container-registry }}
@@ -169,12 +182,23 @@ jobs:
             --build-arg "VCS_REF=$(git rev-parse --short HEAD)" \
             --build-arg "PYTHON_VERSION=$PYTHON_VERSION" \
             --build-arg "PACKAGE_NAME_SHORT=$PACKAGE_NAME_SHORT" \
+            --provenance=true \
+            --sbom=true \
+            --metadata-file metadata.json \
             --cache-from type=gha \
             --cache-to type=gha,mode=max \
             --push \
             -t "$REGISTRY/$IMAGE_NAME:$VERSION-python$PYTHON_VERSION" \
             .
 
+          # Extract the immutable digest for the signing steps below.
+          DIGEST=$(jq -r '."containerimage.digest"' metadata.json)
+          {
+            echo "digest=${DIGEST}"
+            echo "image=${REGISTRY}/${IMAGE_NAME}"
+            echo "pushed=true"
+          } >> "$GITHUB_OUTPUT"
+
           # Pull back a single-arch image for local Trivy scanning.
           # Multi-arch manifests cannot be loaded/scanned; we use the first
           # entry of build-platforms (SCAN_PLATFORM) rather than hardcoding amd64.
@@ -195,8 +219,29 @@ jobs:
             --load \
             -t "$REGISTRY/$IMAGE_NAME:$VERSION-python$PYTHON_VERSION" \
             .
+          echo "pushed=false" >> "$GITHUB_OUTPUT"
         fi
 
+    - name: Install cosign
+      # Only needed when an image was pushed; skip on PR / local-only builds.
+      if: steps.build.outputs.pushed == 'true'
+      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
+
+    - name: Sign container image (keyless / OIDC)
+      if: steps.build.outputs.pushed == 'true'
+      env:
+        DIGEST: ${{ steps.build.outputs.digest }}
+        IMAGE: ${{ steps.build.outputs.image }}
+      run: cosign sign --yes "$IMAGE@$DIGEST"
+
+    - name: Attach SLSA provenance attestation
+      if: steps.build.outputs.pushed == 'true'
+      uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
+      with:
+        subject-name: ${{ steps.build.outputs.image }}
+        subject-digest: ${{ steps.build.outputs.digest }}
+        push-to-registry: true
+
     - name: Run Trivy security scan
       uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
       with:

.github/workflows/dev-pypi.yml

@@ -80,12 +80,12 @@ jobs:
           echo "VERSION=${{ needs.config.outputs.package-version }}"
           echo "TARGET=testpypi"
         } >> "$GITHUB_ENV"
-        echo "Publishing to: TestPyPI with version: $VERSION"
+        echo "Publishing to: TestPyPI with version: ${{ needs.config.outputs.package-version }}"
 
     - name: Setup Python and UV
       uses: ./.github/actions/setup-uv-cached
       with:
-        cache-key: deps-${{ needs.config.outputs.default-python-version }}-${{ hashFiles('.project.yml', 'pyproject.toml', 'requirements*.txt') }}
+        cache-key: deps-${{ needs.config.outputs.default-python-version }}-${{ hashFiles('.project.yml', 'pyproject.toml', 'uv.lock') }}
         fail-on-cache-miss: false
 
     - name: Setup Bun (for UI static bundle)
@@ -143,7 +143,7 @@ jobs:
     - name: Setup Python and UV
       uses: ./.github/actions/setup-uv-cached
       with:
-        cache-key: deps-${{ needs.config.outputs.default-python-version }}-${{ hashFiles('.project.yml', 'pyproject.toml', 'requirements*.txt') }}
+        cache-key: deps-${{ needs.config.outputs.default-python-version }}-${{ hashFiles('.project.yml', 'pyproject.toml', 'uv.lock') }}
         fail-on-cache-miss: false
 
     - name: Generate SBOM files
@@ -156,6 +156,7 @@ jobs:
         name: reports-sbom-${{ needs.config.outputs.package-version }}
         path: |
           python-sbom-cyclonedx.json
+          python-sbom.json
           python-sbom-spdx.json
         retention-days: 180