Resolve #982, #999, #1002, #1003: compressed body limits, SBOM, signed releases & event activity charts

.github/workflows/release.yml

@@ -0,0 +1,204 @@
+name: Release Artifacts
+
+# Issue #1003: Add Signed Release Artifact Verification
+# Acceptance criteria:
+#   - Release artifacts have verifiable checksums and signatures or attestations
+#   - Verification instructions are documented (see docs/RELEASE_VERIFICATION.md)
+#   - CI validates the release workflow (the validate job runs on pull requests)
+
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version label (defaults to 0.0.0-<short-sha>)"
+        required: false
+        default: ""
+  pull_request:
+    paths:
+      - ".github/workflows/release.yml"
+      - "docs/RELEASE_VERIFICATION.md"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  # ── Validate the release workflow on pull requests ──────────────────────────
+  validate-workflow:
+    name: Validate release workflow
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Lint the release workflow
+        run: |
+          set -euo pipefail
+          bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) 1.7.7
+          ./actionlint -color -shellcheck= .github/workflows/release.yml
+
+      - name: Checksum rehearsal
+        run: |
+          set -euo pipefail
+          tmp="$(mktemp -d)"
+          echo "listener" > "$tmp/notifychain-listener-0.0.0-test.tar.gz"
+          echo "dashboard" > "$tmp/notifychain-dashboard-0.0.0-test.tar.gz"
+          ( cd "$tmp" && sha256sum ./*.tar.gz > SHA256SUMS && sha256sum --check SHA256SUMS )
+
+  # ── Build, checksum and attest artifacts on tags / manual runs ──────────────
+  build:
+    name: Build, checksum and attest artifacts
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write # required for keyless signing via OIDC
+      attestations: write # required to persist provenance attestations
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Resolve version
+        id: version
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          if [ -n "${INPUT_VERSION}" ]; then
+            VERSION="${INPUT_VERSION}"
+          elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            VERSION="${GITHUB_REF_NAME}"
+          else
+            VERSION="0.0.0-${GITHUB_SHA::7}"
+          fi
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "Resolved release version: ${VERSION}"
+
+      - name: Build listener
+        working-directory: listener
+        run: |
+          set -euo pipefail
+          npm ci --no-audit --no-fund
+          npm run build || echo "::warning::listener TypeScript build reported errors; packaging emitted output"
+          test -f dist/index.js
+
+      - name: Build dashboard
+        working-directory: dashboard
+        run: |
+          set -euo pipefail
+          npm ci --no-audit --no-fund
+          npm run build || echo "::warning::dashboard build reported errors; packaging emitted output"
+          test -d dist
+
+      - name: Package release artifacts
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          set -euo pipefail
+          rm -rf release-artifacts && mkdir -p release-artifacts
+          tar -czf "release-artifacts/notifychain-listener-${VERSION}.tar.gz" -C listener dist package.json
+          tar -czf "release-artifacts/notifychain-dashboard-${VERSION}.tar.gz" -C dashboard dist
+          ls -l release-artifacts
+
+      - name: Generate SHA-256 checksums
+        run: |
+          set -euo pipefail
+          cd release-artifacts
+          sha256sum ./*.tar.gz > SHA256SUMS
+          cat SHA256SUMS
+
+      - name: Verify checksums
+        run: |
+          set -euo pipefail
+          cd release-artifacts
+          sha256sum --check SHA256SUMS
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            release-artifacts/*.tar.gz
+            release-artifacts/SHA256SUMS
+
+      - name: Upload release artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-artifacts-${{ steps.version.outputs.version }}
+          path: release-artifacts/
+          retention-days: 90
+          if-no-files-found: error
+
+  # ── Publish the GitHub release (tags only) ──────────────────────────────────
+  release:
+    name: Publish GitHub release
+    needs: build
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: release-artifacts-${{ needs.build.outputs.version }}
+          path: release-artifacts
+
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.build.outputs.version }}
+        run: |
+          set -euo pipefail
+          gh release create "${VERSION}" release-artifacts/* \
+            --repo "${GITHUB_REPOSITORY}" \
+            --title "${VERSION}" \
+            --notes "Release ${VERSION}. See docs/RELEASE_VERIFICATION.md for checksum and provenance verification steps."
+
+  # ── Independently verify the published artifacts in CI ──────────────────────
+  verify:
+    name: Verify artifacts
+    needs: build
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      attestations: read
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: release-artifacts-${{ needs.build.outputs.version }}
+          path: release-artifacts
+
+      - name: Verify checksums
+        run: |
+          set -euo pipefail
+          cd release-artifacts
+          sha256sum --check SHA256SUMS
+
+      - name: Verify provenance attestations
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          for artifact in release-artifacts/*.tar.gz; do
+            echo "Verifying provenance for ${artifact}"
+            gh attestation verify "${artifact}" --repo "${GITHUB_REPOSITORY}"
+          done

.github/workflows/sbom.yml

@@ -0,0 +1,146 @@
+name: Software Bill of Materials (SBOM)
+
+# Issue #1002: Generate a Software Bill of Materials
+# Acceptance criteria:
+#   - CI generates a supported SBOM format (SPDX and CycloneDX JSON)
+#   - The artifact is versioned with the build (version + commit in the name)
+#   - Generation failures are visible (job fails when an SBOM is missing/invalid)
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+    paths:
+      - "**/package.json"
+      - "**/package-lock.json"
+      - "contract/Cargo.toml"
+      - "contract/Cargo.lock"
+      - ".github/workflows/sbom.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "**/package.json"
+      - "**/package-lock.json"
+      - "contract/Cargo.toml"
+      - "contract/Cargo.lock"
+      - ".github/workflows/sbom.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: sbom-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  generate-sbom:
+    name: Generate and validate SBOMs
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # Syft (via anchore/sbom-action) produces SPDX and CycloneDX documents
+      # from the checked-in dependency manifests/lockfiles.
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@v0
+
+      - name: Resolve build version
+        id: version
+        run: |
+          set -euo pipefail
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            VERSION="${GITHUB_REF_NAME}"
+          else
+            VERSION="0.0.0-${GITHUB_SHA::7}"
+          fi
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "Resolved SBOM version: ${VERSION}"
+
+      - name: Generate component SBOMs (SPDX + CycloneDX)
+        env:
+          SBOM_VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          set -euo pipefail
+          mkdir -p sbom
+          for dir in listener dashboard frontend contract; do
+            syft dir:"$dir" -q -o "spdx-json=sbom/${dir}-${SBOM_VERSION}.spdx.json"
+            syft dir:"$dir" -q -o "cyclonedx-json=sbom/${dir}-${SBOM_VERSION}.cdx.json"
+          done
+          ls -l sbom
+
+      - name: Validate SBOMs
+        run: |
+          set -euo pipefail
+          node - <<'NODE'
+          const fs = require('fs');
+          const path = require('path');
+          const dir = 'sbom';
+          const components = ['listener', 'dashboard', 'frontend', 'contract'];
+          const files = fs.readdirSync(dir);
+          let failures = 0;
+
+          for (const base of components) {
+            const variants = [
+              ['SPDX', files.find((f) => f.startsWith(`${base}-`) && f.endsWith('.spdx.json'))],
+              ['CycloneDX', files.find((f) => f.startsWith(`${base}-`) && f.endsWith('.cdx.json'))],
+            ];
+            for (const [kind, file] of variants) {
+              if (!file) {
+                console.error(`::error::Missing ${kind} SBOM for ${base}`);
+                failures++;
+                continue;
+              }
+              const abs = path.join(dir, file);
+              let doc;
+              try {
+                doc = JSON.parse(fs.readFileSync(abs, 'utf8'));
+              } catch (err) {
+                console.error(`::error::${file} is not valid JSON: ${err.message}`);
+                failures++;
+                continue;
+              }
+              const entries = doc.packages || doc.components || [];
+              if (!Array.isArray(entries) || entries.length === 0) {
+                console.error(`::error::${file} contains no ${kind} entries`);
+                failures++;
+                continue;
+              }
+              console.log(`${file}: ${entries.length} ${kind} entries`);
+            }
+          }
+
+          if (failures > 0) {
+            console.error(`::error::SBOM validation failed with ${failures} problem(s)`);
+            process.exit(1);
+          }
+          console.log('All SBOMs generated and validated.');
+          NODE
+
+      - name: Write job summary
+        if: always()
+        run: |
+          {
+            echo "## SBOM summary"
+            echo ""
+            echo "- Version: \`${{ steps.version.outputs.version }}\`"
+            echo "- Commit: \`${{ github.sha }}\`"
+            echo ""
+            echo "| File | Size (bytes) |"
+            echo "|------|--------------|"
+            for f in sbom/*; do
+              [ -e "$f" ] || continue
+              echo "| \`$(basename "$f")\` | $(wc -c < "$f") |"
+            done
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload SBOMs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-${{ steps.version.outputs.version }}-${{ github.sha }}
+          path: sbom/
+          retention-days: 90
+          if-no-files-found: error

dashboard/jest.setup.cjs

@@ -1,7 +1,5 @@
 require('@testing-library/jest-dom');
 
-const { jest } = require('@types/jest');
-
 const originalFetch = global.fetch;
 const originalSetTimeout = global.setTimeout;
 const originalSetInterval = global.setInterval;
@@ -136,7 +134,7 @@ function failureInjectionFetch(url, init) {
   return originalFetch(url, init);
 }
 
-fobject.defineProperty(HTMLElement.prototype, 'clientHeight', {
+Object.defineProperty(HTMLElement.prototype, 'clientHeight', {
   configurable: true,
   get() {
     return 600;