test(validate-submission): accept a real build-module attestation from main

scripts/fixtures/attestation-build-module-main.json

@@ -0,0 +1,43 @@
+[
+	{
+		"verificationResult": {
+			"statement": {
+				"subject": [
+					{
+						"name": "build-fixture@0.1.0.zip",
+						"digest": {
+							"sha256": "6889aebe4ba68878bc029484448cb826a8e931ea158c71cc3bdeb2bc4068aa21"
+						}
+					}
+				],
+				"predicateType": "https://slsa.dev/provenance/v1"
+			},
+			"signature": {
+				"certificate": {
+					"certificateIssuer": "CN=sigstore-intermediate,O=sigstore.dev",
+					"subjectAlternativeName": "https://github.com/spicetify/actions/.github/workflows/build-module.yml@refs/heads/main",
+					"issuer": "https://token.actions.githubusercontent.com",
+					"githubWorkflowTrigger": "push",
+					"githubWorkflowSHA": "91b890c761e773236bed6cb3ab78da223b83e523",
+					"githubWorkflowName": "Test build-module",
+					"githubWorkflowRepository": "spicetify/actions",
+					"githubWorkflowRef": "refs/heads/main",
+					"buildSignerURI": "https://github.com/spicetify/actions/.github/workflows/build-module.yml@refs/heads/main",
+					"buildSignerDigest": "91b890c761e773236bed6cb3ab78da223b83e523",
+					"runnerEnvironment": "github-hosted",
+					"sourceRepositoryURI": "https://github.com/spicetify/actions",
+					"sourceRepositoryDigest": "91b890c761e773236bed6cb3ab78da223b83e523",
+					"sourceRepositoryRef": "refs/heads/main",
+					"sourceRepositoryIdentifier": "1330299426",
+					"sourceRepositoryOwnerURI": "https://github.com/spicetify",
+					"sourceRepositoryOwnerIdentifier": "100136310",
+					"buildConfigURI": "https://github.com/spicetify/actions/.github/workflows/test-build-module.yml@refs/heads/main",
+					"buildConfigDigest": "91b890c761e773236bed6cb3ab78da223b83e523",
+					"buildTrigger": "push",
+					"runInvocationURI": "https://github.com/spicetify/actions/actions/runs/37997562109/attempts/1",
+					"sourceRepositoryVisibilityAtSigning": "public"
+				}
+			}
+		}
+	}
+]

scripts/validate-submission.test.mts

@@ -82,6 +82,20 @@ describe("provenanceFrom", () => {
 	);
 	const fixtureZip = "sha256:545ecd7c800fcbca7d89ad7ca1246e90ee86812faaf9adc82c5ddd8a220d43db";
 
+	// The same fixture module built by build-module on main.
+	const released = JSON.parse(
+		readFileSync(new URL("./fixtures/attestation-build-module-main.json", import.meta.url), "utf8"),
+	);
+	const releasedZip = "sha256:6889aebe4ba68878bc029484448cb826a8e931ea158c71cc3bdeb2bc4068aa21";
+
+	it("accepts the builder at main and reports the commit the zip was built from", () => {
+		const result = provenanceFrom(released, releasedZip, "spicetify/actions");
+		assert.ok("provenance" in result, reason(result));
+		assert.equal(result.provenance.commit, "91b890c761e773236bed6cb3ab78da223b83e523");
+		assert.equal(result.provenance.ref, "refs/heads/main");
+		assert.match(result.provenance.run, /\/actions\/runs\/37997562109\//);
+	});
+
 	it("refuses the builder at a ref that is neither a release nor main", () => {
 		assert.match(reason(provenanceFrom(unreleased, fixtureZip, "spicetify/actions")), /refs\/pull\/4\/merge/);
 	});