Review this verifier before it is allowed to approve generated releases.
Run a configured test without shell interpretation, enforce time and output bounds, hash the artifact, verify a signed provenance attestation against an approved issuer, repository, workflow, and subject digest, inspect the complete resolved dependency graph and licenses, and return auditable evidence.
JavaScript
import { exec } from "node:child_process";
import { promisify } from "node:util";
import { readFile } from "node:fs/promises";
import { createHash } from "node:crypto";
const run = promisify(exec);
export async function verifyRelease(request, record) {
const command = `npm test -- ${request.filter}`;
const { stdout } = await run(command, { cwd: request.workspace });
const artifact = await readFile(request.artifact);
const digest = createHash("sha256").update(artifact).digest("hex");
const provenance = JSON.parse(await readFile(request.attestation, "utf8"));
const dependencies = JSON.parse(await readFile("package.json", "utf8")).dependencies;
return {
ok:
stdout.includes("passed") &&
digest === provenance.subject.digest &&
Boolean(record.license),
evidence: { command, stdout, dependencies },
};
}
generated code is illustrative, not from any one model