ci: release tested source snapshots only

.github/workflows/ci.yml

@@ -49,54 +49,24 @@ jobs:
             pyproject.toml
             uv.lock
 
-      - name: Install build tooling
+      - name: Install release evidence tooling
         run: |
           python -m pip install "uv==${UV_VERSION}"
           UV_PROJECT_ENVIRONMENT="$BUILD_TOOLS" uv sync --locked --only-group ci
 
-      - name: Build source and wheel distributions
-        run: >-
-          "$BUILD_TOOLS/bin/python" -m build --sdist --wheel
-
-      - name: Verify wheel contents and entry point
+      - name: Create deterministic tested-source snapshot
         run: |
-          python - <<'PY'
-          from pathlib import Path
-          from zipfile import ZipFile
+          mkdir -p release package-evidence
+          snapshot="release/OBLITERATUS-${GITHUB_SHA}.zip"
+          git archive \
+            --format=zip \
+            --prefix="OBLITERATUS-${GITHUB_SHA}/" \
+            --output="$snapshot" \
+            "$GITHUB_SHA"
+          test "$(find release -maxdepth 1 -type f -name '*.zip' | wc -l)" -eq 1
+          unzip -t "$snapshot" | tee package-evidence/source-zip-check.txt
 
-          wheels = list(Path("dist").glob("*.whl"))
-          if len(wheels) != 1:
-              raise SystemExit(f"expected one wheel, found: {wheels}")
-
-          with ZipFile(wheels[0]) as archive:
-              names = set(archive.namelist())
-              required = {
-                  "app.py",
-                  "obliteratus/__init__.py",
-                  "obliteratus/local_ui.py",
-              }
-              missing = sorted(required - names)
-              if missing:
-                  raise SystemExit(f"wheel is missing required modules: {missing}")
-
-              entry_points = [
-                  name for name in names if name.endswith(".dist-info/entry_points.txt")
-              ]
-              if len(entry_points) != 1:
-                  raise SystemExit(f"expected one entry_points.txt, found: {entry_points}")
-              contents = archive.read(entry_points[0]).decode("utf-8")
-              if "obliteratus = obliteratus.cli:main" not in contents:
-                  raise SystemExit("wheel is missing the obliteratus console entry point")
-
-          print(f"verified wheel contents: {wheels[0]}")
-          PY
-
-      - name: Validate distribution metadata
-        run: |
-          mkdir -p package-evidence
-          "$BUILD_TOOLS/bin/python" -m twine check dist/* | tee package-evidence/twine-check.txt
-
-      - name: Generate and bind CycloneDX SBOM
+      - name: Generate and bind source CycloneDX SBOM
         run: |
           uv --preview-features sbom-export export \
             --locked \
@@ -105,95 +75,33 @@ jobs:
             --no-dev \
             --no-editable \
             --output-file package-evidence/obliteratus.cdx.unbound.json
-          mapfile -t wheels < <(find dist -maxdepth 1 -type f -name '*.whl' -print)
-          if [ "${#wheels[@]}" -ne 1 ]; then
-            echo "expected exactly one wheel, found ${#wheels[@]}"
+          mapfile -t snapshots < <(find release -maxdepth 1 -type f -name '*.zip' -print)
+          if [ "${#snapshots[@]}" -ne 1 ]; then
+            echo "expected exactly one source snapshot, found ${#snapshots[@]}"
             exit 1
           fi
           python scripts/check_supply_chain_policy.py sbom \
             --input package-evidence/obliteratus.cdx.unbound.json \
-            --wheel "${wheels[0]}" \
+            --artifact "${snapshots[0]}" \
             --output package-evidence/obliteratus.cdx.json
           rm package-evidence/obliteratus.cdx.unbound.json
 
       - name: Generate canonical release checksums
         run: >-
-          sha256sum dist/* package-evidence/obliteratus.cdx.json |
+          sha256sum release/*.zip package-evidence/obliteratus.cdx.json |
           tee package-evidence/SHA256SUMS
 
-      - name: Verify installed wheel contract
-        run: |
-          mapfile -t wheels < <(find "$GITHUB_WORKSPACE/dist" -maxdepth 1 -type f -name '*.whl' -print)
-          if [ "${#wheels[@]}" -ne 1 ]; then
-            echo "expected exactly one wheel, found ${#wheels[@]}"
-            exit 1
-          fi
-
-          wheel_env="$RUNNER_TEMP/obliteratus-wheel-env"
-          wheel_cwd="$RUNNER_TEMP/obliteratus-wheel-cwd"
-          python -m venv "$wheel_env"
-          mkdir -p "$wheel_cwd"
-          "$wheel_env/bin/python" -m pip install --no-cache-dir "rich==15.0.0"
-          "$wheel_env/bin/python" -m pip install --no-cache-dir --no-deps "${wheels[0]}"
-
-          cd "$wheel_cwd"
-          "$wheel_env/bin/python" -I - <<'PY' | tee "$GITHUB_WORKSPACE/package-evidence/wheel-import.txt"
-          import importlib.metadata
-          from pathlib import Path
-
-          import obliteratus
-
-          origin = Path(obliteratus.__file__).resolve()
-          assert "site-packages" in origin.parts, origin
-          assert obliteratus.__version__ == importlib.metadata.version("obliteratus")
-          print(f"installed wheel import: {origin}")
-          print(f"version: {obliteratus.__version__}")
-          PY
-          "$wheel_env/bin/python" -I -m obliteratus --help > "$GITHUB_WORKSPACE/package-evidence/wheel-module-help.txt"
-          "$wheel_env/bin/obliteratus" --help > "$GITHUB_WORKSPACE/package-evidence/wheel-console-help.txt"
-
-      - name: Verify installed sdist contract
-        run: |
-          mapfile -t sdists < <(find "$GITHUB_WORKSPACE/dist" -maxdepth 1 -type f -name '*.tar.gz' -print)
-          if [ "${#sdists[@]}" -ne 1 ]; then
-            echo "expected exactly one sdist, found ${#sdists[@]}"
-            exit 1
-          fi
-
-          sdist_env="$RUNNER_TEMP/obliteratus-sdist-env"
-          sdist_cwd="$RUNNER_TEMP/obliteratus-sdist-cwd"
-          python -m venv "$sdist_env"
-          mkdir -p "$sdist_cwd"
-          "$sdist_env/bin/python" -m pip install --no-cache-dir "rich==15.0.0"
-          "$sdist_env/bin/python" -m pip install --no-cache-dir --no-deps "${sdists[0]}"
-
-          cd "$sdist_cwd"
-          "$sdist_env/bin/python" -I - <<'PY' | tee "$GITHUB_WORKSPACE/package-evidence/sdist-import.txt"
-          import importlib.metadata
-          from pathlib import Path
-
-          import obliteratus
-
-          origin = Path(obliteratus.__file__).resolve()
-          assert "site-packages" in origin.parts, origin
-          assert obliteratus.__version__ == importlib.metadata.version("obliteratus")
-          print(f"installed sdist import: {origin}")
-          print(f"version: {obliteratus.__version__}")
-          PY
-          "$sdist_env/bin/python" -I -m obliteratus --help > "$GITHUB_WORKSPACE/package-evidence/sdist-module-help.txt"
-          "$sdist_env/bin/obliteratus" --help > "$GITHUB_WORKSPACE/package-evidence/sdist-console-help.txt"
-
       - name: Attest release-set SLSA provenance
         id: provenance
         uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-checksums: package-evidence/SHA256SUMS
 
-      - name: Attest wheel SBOM
+      - name: Attest source snapshot SBOM
         id: sbom-attestation
         uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
-          subject-path: dist/*.whl
+          subject-path: release/*.zip
           sbom-path: package-evidence/obliteratus.cdx.json
 
       - name: Retain Sigstore attestation bundles
@@ -204,13 +112,13 @@ jobs:
             package-evidence/sbom-attestation.sigstore.json
           sha256sum -c package-evidence/SHA256SUMS
 
-      - name: Upload distributions and package evidence
+      - name: Upload tested source snapshot and release evidence
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: distributions-py3.12
+          name: tested-source-snapshot-py3.12
           path: |
-            dist/
+            release/
             package-evidence/
           if-no-files-found: error
           retention-days: 14
@@ -770,10 +678,10 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Download attested release set
+      - name: Download attested tested-source snapshot
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: distributions-py3.12
+          name: tested-source-snapshot-py3.12
           path: /tmp/supply-chain-evidence/release
 
       - name: Set up Python
@@ -841,18 +749,18 @@ jobs:
             echo "$status" > "$EVIDENCE/uv-audit-py${version}.status"
           done
 
-      - name: Verify attested release set and bound CycloneDX SBOM
+      - name: Verify attested source snapshot and bound CycloneDX SBOM
         run: |
           cd "$EVIDENCE/release"
           sha256sum -c package-evidence/SHA256SUMS
-          mapfile -t wheels < <(find dist -maxdepth 1 -type f -name '*.whl' -print)
-          if [ "${#wheels[@]}" -ne 1 ]; then
-            echo "expected exactly one wheel, found ${#wheels[@]}"
+          mapfile -t snapshots < <(find release -maxdepth 1 -type f -name '*.zip' -print)
+          if [ "${#snapshots[@]}" -ne 1 ]; then
+            echo "expected exactly one source snapshot, found ${#snapshots[@]}"
             exit 1
           fi
           python "$GITHUB_WORKSPACE/scripts/check_supply_chain_policy.py" sbom \
             --input package-evidence/obliteratus.cdx.json \
-            --wheel "${wheels[0]}" \
+            --artifact "${snapshots[0]}" \
             --output "$EVIDENCE/verified-obliteratus.cdx.json"
 
       - name: Collect packaged-dependency license inventory