fix(ci): stabilize sbom attestation contract in npm publish

Author: Jacobinwwey

.github/workflows/npm-publish.yml

@@ -17,8 +17,6 @@ env:
   NOTE_CONNECTION_SBOM_ATTESTATION_REVOKED_KEY_IDS: ${{ secrets.SBOM_SIGNING_REVOKED_KEY_IDS }}
   NOTE_CONNECTION_SBOM_ATTESTATION_MIN_RSA_BITS: "2048"
   NOTE_CONNECTION_SBOM_ATTESTATION_MIN_ROTATION_OVERLAP_HOURS: "24"
-  NOTE_CONNECTION_SBOM_ATTESTATION_ENABLE_TRANSPARENCY_LOG: "true"
-  NOTE_CONNECTION_SBOM_ATTESTATION_TRANSPARENCY_LOG_PATH: "build/sbom/attestation-transparency-log.jsonl"
   NOTE_CONNECTION_RELEASE_COMMIT_SHA: ${{ github.sha }}
   NOTE_CONNECTION_RELEASE_GIT_TAG: ${{ github.ref_name }}
   NOTE_CONNECTION_RELEASE_REF: ${{ github.ref }}

src/sbom.attestation.policy.contract.test.ts

@@ -12,6 +12,16 @@ function readJson<T>(filePath: string): T {
   return JSON.parse(fs.readFileSync(filePath, 'utf8')) as T;
 }
 
+function buildUnsignedGeneratorEnv(): NodeJS.ProcessEnv {
+  return {
+    ...process.env,
+    NOTE_CONNECTION_SBOM_SIGNING_PRIVATE_KEY_PEM: '',
+    NOTE_CONNECTION_SBOM_SIGNING_PRIVATE_KEY_FILE: '',
+    NOTE_CONNECTION_SBOM_ATTESTATION_ENABLE_TRANSPARENCY_LOG: '0',
+    NOTE_CONNECTION_SBOM_ATTESTATION_TRANSPARENCY_LOG_PATH: '',
+  };
+}
+
 describe('sbom attestation policy contract', () => {
   const repoRoot = path.resolve(__dirname, '..');
   const packageJsonPath = path.join(repoRoot, 'package.json');
@@ -154,6 +164,7 @@ describe('sbom attestation policy contract', () => {
       cwd: repoRoot,
       encoding: 'utf8',
       stdio: 'pipe',
+      env: buildUnsignedGeneratorEnv(),
     });
     expect(generateResult.status).toBe(0);
 
@@ -202,6 +213,7 @@ describe('sbom attestation policy contract', () => {
       cwd: repoRoot,
       encoding: 'utf8',
       stdio: 'pipe',
+      env: buildUnsignedGeneratorEnv(),
     });
     expect(generateResult.status).toBe(0);
 
@@ -258,6 +270,7 @@ describe('sbom attestation policy contract', () => {
       cwd: repoRoot,
       encoding: 'utf8',
       stdio: 'pipe',
+      env: buildUnsignedGeneratorEnv(),
     });
     expect(generateResult.status).toBe(0);
 
@@ -308,6 +321,7 @@ describe('sbom attestation policy contract', () => {
       cwd: repoRoot,
       encoding: 'utf8',
       stdio: 'pipe',
+      env: buildUnsignedGeneratorEnv(),
     });
     expect(generateResult.status).toBe(0);