Supply chain at the server side layer

# ABOUTME: Builds the agent image, signs with cosign (keyless via GitHub OIDC), generates SPDX SBOM, attaches as attestation.
# ABOUTME: id-token: write is required for keyless signing. Drop in .github/workflows/. Match the OIDC subject in the Kyverno verifyImages policy.
name: Build and sign agent image

on:
  push:
    branches: [main]
    tags: ['v*']
    paths:
      - 'src/**'
      - 'Dockerfile'

permissions:
  contents: read
  packages: write
  id-token: write   # required for cosign keyless signing
  attestations: write

env:
  REGISTRY: ghcr.io
  IMAGE: ${{ github.repository }}/claude-agent

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v6

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE }}
          tags: |
            type=sha,format=long
            type=ref,event=branch
            type=ref,event=tag

      - id: build
        uses: docker/build-push-action@v6
        with:
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          provenance: mode=max
          sbom: true

      - uses: sigstore/cosign-installer@v3

      - name: Cosign sign image (keyless)
        run: |
          cosign sign --yes \
            "${REGISTRY}/${IMAGE}@${{ steps.build.outputs.digest }}"

      - name: Generate SPDX SBOM with syft
        uses: anchore/sbom-action@v0
        with:
          image: ${{ env.REGISTRY }}/${{ env.IMAGE }}@${{ steps.build.outputs.digest }}
          format: spdx-json
          output-file: sbom.spdx.json

      - name: Attach SBOM as cosign attestation
        run: |
          cosign attest --yes \
            --predicate sbom.spdx.json \
            --type spdxjson \
            "${REGISTRY}/${IMAGE}@${{ steps.build.outputs.digest }}"

      - name: Verify signature locally before publishing
        run: |
          cosign verify \
            --certificate-identity-regexp "^https://github.com/${{ github.repository_owner }}/.+/.github/workflows/.+$" \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
            "${REGISTRY}/${IMAGE}@${{ steps.build.outputs.digest }}"

# ABOUTME: CiliumNetworkPolicy restricting agent egress to a fixed list of approved FQDNs at L7 (DNS-aware).
# ABOUTME: Requires Cilium with enable-l7-proxy: true. On a CNI without FQDN support, layer at the egress proxy instead.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: agent-mcp-fqdn-egress
  namespace: agent-claude-prod
spec:
  endpointSelector:
    matchLabels:
      app: claude-code
  egress:

  # Allow HTTPS to a fixed list of FQDNs. Anything not in this list is
  # blocked at the Cilium L7 DNS proxy.
  - toFQDNs:
    - matchName: api.anthropic.com
    - matchName: api.github.com
    - matchName: registry.example.com
    - matchName: ghcr.io
    - matchPattern: "*.s3.us-east-1.amazonaws.com"   # narrow further if you can
    toPorts:
    - ports:
      - port: "443"
        protocol: TCP
      rules:
        http:
        - method: "GET|HEAD|POST|PUT"
          # Optionally constrain paths per host; left open here for breadth.

  # Allow DNS to kube-dns. Without this, FQDN matching cannot resolve names
  # and the agent cannot reach any host, including the allowed ones.
  - toEndpoints:
    - matchLabels:
        k8s:io.kubernetes.pod.namespace: kube-system
        k8s:k8s-app: kube-dns
    toPorts:
    - ports:
      - port: "53"
        protocol: UDP
      - port: "53"
        protocol: TCP
      rules:
        dns:
        - matchPattern: "*"

# ABOUTME: Kyverno ClusterPolicy requiring an SPDX SBOM attestation on every Pod image. Requires Kyverno 1.18+.
# ABOUTME: The condition asserts a syft-generated SBOM; tune for your build tool. Without an SBOM, admission is rejected.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-spdx-sbom
  annotations:
    policies.kyverno.io/title: Require SPDX SBOM attestation on every image
    policies.kyverno.io/category: Agentic Covenants / Supply Chain
    policies.kyverno.io/severity: high
spec:
  validationFailureAction: Enforce
  background: false
  rules:

  - name: require-spdx-attestation
    match:
      any:
      - resources:
          kinds: [Pod]
    verifyImages:
    - imageReferences:
      - "*"
      attestations:
      - type: https://spdx.dev/Document
        conditions:
        - all:
          # Heuristic: assert that syft is named in the SBOM creators block.
          # If you build SBOMs with a different tool (Trivy, cyclonedx-bom),
          # adjust the JMESPath to match.
          - key: "{{ creationInfo.creators[?contains(@, 'syft')] }}"
            operator: NotEquals
            value: ""
        attestors:
        - entries:
          - keyless:
              subject: "https://github.com/example-org/*"
              issuer: "https://token.actions.githubusercontent.com"

# ABOUTME: Kyverno ClusterPolicy verifying cosign keyless signatures + SPDX SBOM attestation. Requires Kyverno 1.18+.
# ABOUTME: Substitute example-org for your GitHub org. The keyless subject regex pins signatures to your org's workflow runs only.
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signatures
  annotations:
    policies.kyverno.io/title: Verify cosign signatures and SPDX attestations
    policies.kyverno.io/category: Agentic Covenants / Supply Chain
    policies.kyverno.io/severity: critical
spec:
  validationFailureAction: Enforce
  background: false
  webhookTimeoutSeconds: 30
  failurePolicy: Fail
  rules:

  - name: verify-cosign-keyless-signature
    match:
      any:
      - resources:
          kinds: [Pod]
          namespaces:
          - "agent-*"
          - "default"
    verifyImages:
    - imageReferences:
      - "ghcr.io/example-org/*"
      attestors:
      - entries:
        - keyless:
            # Subject regex pins signatures to GitHub Actions workflows in this org.
            # subject: "*" accepts anyone's signature; that is the most common
            # misconfiguration of cosign verification.
            subject: "https://github.com/example-org/*/.github/workflows/*"
            issuer: "https://token.actions.githubusercontent.com"
            rekor:
              url: https://rekor.sigstore.dev

  - name: verify-spdx-sbom-attestation
    match:
      any:
      - resources:
          kinds: [Pod]
          namespaces:
          - "agent-*"
          - "default"
    verifyImages:
    - imageReferences:
      - "ghcr.io/example-org/*"
      attestations:
      - type: https://spdx.dev/Document
        attestors:
        - entries:
          - keyless:
              subject: "https://github.com/example-org/*"
              issuer: "https://token.actions.githubusercontent.com"

  - name: deny-non-allowlisted-registries
    match:
      any:
      - resources:
          kinds: [Pod]
    validate:
      message: >-
        Images must come from approved registries only:
        ghcr.io/example-org/* or registry.example.com/*
      pattern:
        spec:
          containers:
          - image: "ghcr.io/example-org/* | registry.example.com/*"

# ABOUTME: CI workflow that validates lockfile integrity even when pre-commit was bypassed with --no-verify.
# ABOUTME: This is the real backstop for client-side lockfile pinning. Drop in .github/workflows/.
name: Lockfile Integrity

on:
  pull_request:
    paths:
      - 'package.json'
      - 'package-lock.json'
      - 'requirements*.txt'
      - 'requirements.in'
      - 'pyproject.toml'
      - 'Pipfile'
      - 'Pipfile.lock'
      - 'poetry.lock'
      - 'go.mod'
      - 'go.sum'
      - 'Cargo.toml'
      - 'Cargo.lock'

jobs:

  npm:
    if: hashFiles('package-lock.json') != ''
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: '24'
      - name: Verify package-lock.json matches package.json
        # npm ci --dry-run fails if the lockfile and manifest are out of sync.
        run: npm ci --dry-run

      - name: Run npm audit (high severity, fail-on)
        run: npm audit --audit-level=high

  python-requirements:
    if: hashFiles('requirements.in') != ''
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: '3.13'
      - name: Verify requirements.txt is the compiled output of requirements.in
        run: |
          pip install pip-tools==7.5.3
          pip-compile --no-header --no-emit-index-url \
            --output-file=/tmp/requirements.lock requirements.in
          if ! diff -q requirements.txt /tmp/requirements.lock >/dev/null 2>&1; then
            echo "::error::requirements.txt does not match the compiled output of requirements.in."
            echo "An agent that edits requirements.txt directly bypasses pip-compile review."
            diff -u requirements.txt /tmp/requirements.lock || true
            exit 1
          fi

      - name: Run pip-audit
        run: |
          pip install pip-audit==2.10.1
          pip-audit --requirement requirements.txt --strict

  poetry:
    if: hashFiles('poetry.lock') != ''
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-python@v6
        with:
          python-version: '3.13'
      - run: pip install poetry==2.4.1
      - name: Verify poetry.lock is in sync with pyproject.toml
        run: poetry check --lock

  go:
    if: hashFiles('go.mod') != ''
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-go@v6
        with:
          go-version: 'stable'
      - name: Verify go.sum matches go.mod
        run: |
          go mod verify
          go mod tidy -diff

  cargo:
    if: hashFiles('Cargo.lock') != ''
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: dtolnay/rust-toolchain@stable
      - name: cargo audit
        run: |
          cargo install cargo-audit --locked
          cargo audit --deny warnings
      - name: Verify Cargo.lock is up to date
        run: cargo update --workspace --locked