feat(release): add reproducible signed artifacts (#19)

.gitea/workflows/ci.yml

@@ -14,16 +14,34 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
 
       - name: Install .NET SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
         with:
           dotnet-version: 10.0.301
 
       - name: Restore locked dependencies
         run: dotnet restore Rendezvous.slnx --locked-mode
 
+      - name: Verify dependency licenses and reviewed transport pin
+        run: python3 eng/release_artifacts.py policy --root .
+
+      - name: Reject vulnerable direct or transitive packages
+        shell: bash
+        run: |
+          set -euo pipefail
+          dotnet package list --project Rendezvous.slnx \
+            --vulnerable --include-transitive --no-restore --format json \
+            >"${RUNNER_TEMP}/nuget-vulnerabilities.json"
+          python3 eng/release_artifacts.py audit \
+            --input "${RUNNER_TEMP}/nuget-vulnerabilities.json"
+
+      - name: Enforce compatibility version bumps
+        run: ./scripts/check-compatibility.sh origin/main
+
       - name: Verify formatting and analyzers
         run: dotnet format Rendezvous.slnx --verify-no-changes --no-restore
 
@@ -98,10 +116,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Install .NET SDK
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
         with:
           dotnet-version: 10.0.301
 
@@ -127,7 +145,10 @@ jobs:
           chmod 0444 "$secret"
           export RENDEZVOUS_UID=1654
           export RENDEZVOUS_GID=1654
-          docker compose -f "$compose_file" up --build --detach
+          export SOURCE_REVISION_ID="$GITHUB_SHA"
+          docker compose -f "$compose_file" build \
+            --build-arg SOURCE_REVISION_ID="$SOURCE_REVISION_ID"
+          docker compose -f "$compose_file" up --no-build --detach
           container_id="$(docker compose -f "$compose_file" ps -q rendezvous)"
           test -n "$container_id"
           test "$(docker inspect --format '{{.Config.User}}' "$container_id")" = "1654:1654"