Authenticate OCI evidence publication

[0xsl1m]

Incident follow-up

The guarded v0.6.3 evidence recovery successfully verified both immutable tags, prior exact-source SLSA provenance, labels, source CI, rescanned the exact image, and skipped new provenance. It then stopped when actions/attest attempted to attach the CycloneDX OCI referrer because the no-push recovery path intentionally had no GHCR credentials.

Fix

• authenticate to GHCR only after immutable subject verification, vulnerability scanning, digest re-verification, and deterministic SBOM canonicalization
• keep the credentialed window limited to the two pinned attestation steps
• retain the existing guard that makes provenance impossible during manual recovery
• perform unconditional docker logout ghcr.io immediately after SBOM attestation, before signed-evidence verification and the isolated anonymous pull
• add workflow-policy assertions for the exact ordering, password-stdin login, and fail-closed logout

No image tag or package content is built, changed, or pushed by this recovery path. The intended write is only the digest-bound CycloneDX OCI attestation.

Verification

• affected workflow/production tests: 22 passed
• Actionlint clean
• all eight Bash run blocks pass bash -n
• Ruff lint/format and diff checks clean
• independent security re-review: GO; no tag-mutation, signing-oracle, or source-binding issue introduced

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
shadowshield	Ready	Preview, Comment	Jul 25, 2026 10:53pm