test(validate-submission): accept a real build-module attestation from main

[afonsojramos]

Summary

Adds the accept-path test for attestation verification, using a real attestation: spicetify/actions build-module building its fixture module on main (run 37997562109). provenanceFrom must verify it and report the source commit, ref, and run. The existing fixtures already cover refusals (a pull request ref of the builder, and a different signing workflow).

Validation

• node --test scripts/validate-submission.test.mts: 32 passed.
• pnpm fmt:check and pnpm check pass.
• verifyWithGh was run against the real zip from that run and returned the same provenance (spicetify/actions@91b890c).

Summary by CodeRabbit

• Tests
  • Added validation coverage for build provenance attestations, including checks that a recorded artifact digest and repository match and that the associated commit, source reference, and workflow run are returned correctly.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4e0cc2a7-b630-409d-ae33-f8aa55a31429

---

📥 Commits

Reviewing files that changed from the base of the PR and between 4d034f2 and 8647b5f.

---

📒 Files selected for processing (2)

• scripts/fixtures/attestation-build-module-main.json
• scripts/validate-submission.test.mts

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

Walkthrough

The change adds a SLSA provenance attestation fixture for a build-module ZIP. A test checks that provenanceFrom accepts the fixture and returns the expected commit, branch ref, and Actions run URL.

Changes

Build-module provenance validation

Layer / File(s)	Summary
Fixture-backed provenance validation scripts/fixtures/attestation-build-module-main.json, scripts/validate-submission.test.mts	The fixture records a build-module ZIP digest and SLSA provenance metadata. The test checks the matching digest and repository, then verifies the returned commit, refs/heads/main ref, and Actions run URL.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 8647b

This adds regression coverage for a main-branch build attestation without changing runtime validation behavior. No actionable merge-blocking risk is apparent.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly describes the main change: adding a validation test that accepts a real build-module attestation from the main branch.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

---

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{A rabbit checks the build’s small trail,
And finds the commit, ref, and run.
The ZIP’s attestation joins the test,
Its recorded digest matches the one.
Then off I hop beneath the moon.}

_{Comment @coderabbitai help to get the list of available commands.}

[pullfrog]

✅ No new issues found.

Reviewed changes

This run reviewed the full PR: a test-only addition of the main-ref accept path for provenanceFrom, backed by a real build-module attestation fixture.

• New fixture scripts/fixtures/attestation-build-module-main.json — a real gh attestation verify --format json result signed by spicetify/actions/.github/workflows/build-module.yml@refs/heads/main, source commit 91b890c761e773236bed6cb3ab78da223b83e523, digest sha256:6889aebe…aa21, run 37997562109.
• New test scripts/validate-submission.test.mts:91 — asserts provenanceFrom(released, releasedZip, "spicetify/actions") returns a provenance carrying the expected commit, ref, and run, complementing the existing refusal fixtures (PR-ref builder, foreign signer).

The fixture digest matches the test's releasedZip, and every field lines up with the checks in provenanceFrom (source repository, buildSignerURI prefix plus refs/heads/main, github-hosted runner, 40-hex commit). Verified locally: node --test scripts/validate-submission.test.mts → 32 pass, pnpm fmt:check clean. The tsc errors in modules/stdlib/src/registers/* are pre-existing and untouched by this diff.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}