feat: add artifact attestation verification

Author: bordumb

.github/workflows/ci.yml

@@ -44,3 +44,15 @@ jobs:
         uses: ./
         with:
           fail-on-unsigned: true
+
+  verify-artifacts:
+    runs-on: ubuntu-latest
+    needs: build-and-test
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Verify dist/index.js attestation
+        uses: ./
+        with:
+          artifact-paths: 'dist/index.js'
+          fail-on-unattested: false

.gitignore

@@ -12,4 +12,4 @@ dist/**/*.d.ts.map
 
 # Local tool directories
 .deepeval/
-.flow/
+.flow/

dist/__tests__/artifact-integration.test.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Integration tests for artifact verification in main.ts run() flow.
+ *
+ * Since run() is called at module load time, we use jest.isolateModules
+ * to re-import the module with different mock configurations per test.
+ */
+declare let mockInputs: Record<string, string>;
+declare let mockMultilineInputs: Record<string, string[]>;
+declare let mockOutputs: Record<string, string>;
+declare let mockFailed: string[];
+declare let mockWarnings: string[];
+declare let mockGlobFiles: string[];
+declare let mockArtifactResults: any[];
+declare let mockVerifyCommitsResult: any[];
+declare const mockVerifyCommits: jest.Mock<any, any, any>;
+declare const mockEnsureAuthsInstalled: jest.Mock<any, any, any>;
+declare const mockVerifyArtifact: jest.Mock<any, any, any>;
+declare const mockRunPreflightChecks: jest.Mock<any, any, any>;
+declare function resetMockState(): void;
+declare function runMain(): Promise<void>;