Supply chain round 2: hardened native flags, SBOM, attestations

.github/workflows/release.yml

@@ -49,11 +49,14 @@ jobs:
         if: runner.os != 'Windows'
         run: |
           mv target/${{ matrix.artifact }} ai-commit-${{ matrix.platform }}
+          cp target/bom.json ai-commit-${{ matrix.platform }}.bom.json
           chmod +x ai-commit-${{ matrix.platform }}
 
       - name: Rename Artifact (Windows)
         if: runner.os == 'Windows'
-        run: Move-Item target/${{ matrix.artifact }} ai-commit-${{ matrix.platform }}.exe
+        run: |
+          Move-Item target/${{ matrix.artifact }} ai-commit-${{ matrix.platform }}.exe
+          Copy-Item target/bom.json ai-commit-${{ matrix.platform }}.bom.json
 
       - name: Generate SHA256 (Unix)
         if: runner.os != 'Windows'
@@ -80,6 +83,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/v')
     permissions:
       contents: write
+      id-token: write
+      attestations: write
 
     steps:
       - name: Checkout
@@ -91,6 +96,11 @@ jobs:
           path: artifacts
           merge-multiple: true
 
+      - name: Attest Build Provenance
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: 'artifacts/**/*'
+
       - name: Display Structure
         run: ls -R artifacts || ls -R .
 

CHANGELOG.md

@@ -27,6 +27,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Single staged-diff fetch per run; bounded process capture; release builds run `mvn clean verify` (tests + coverage gate, no skips).
 - Dependency hygiene: slf4j 2.0.20, JUnit 6.1.3, Mockito 5.23.0, maven-compiler 3.15.0, maven-shade 3.6.2, maven-surefire 3.5.6, native-maven-plugin 0.11.5.
 - GitHub Actions moved to Node 24 runtimes: checkout v5, cache v5, upload-artifact v6, download-artifact v7, gh-release v3 (setup-graalvm v1 already current).
+- Native image hardened: removed deprecated `--allow-incomplete-classpath`, unsafe ServiceLoader disable, stale logback/slf4j build-time init, broad resource globs, and deprecated URL-protocol flags (https handlers now in reachability metadata); default `-O2` for releases.
+- Supply chain: CycloneDX SBOM (`bom.json`) generated on every build and attached to releases; SLSA build provenance attested keylessly via GitHub OIDC.
 
 ### Technical
 - JaCoCo 0.8.15 enforces 90% line + branch coverage on `verify` (currently 96.2% line, 90.5% branch across 168 tests).

README.md

@@ -53,7 +53,7 @@ So I built this. A standalone CLI that works everywhere, supports any OpenAI-com
 
 ### Option 1: One-Line Installer (Easiest)
 
-Installers verify the release SHA256 checksum before installing. Pin a version with `AI_COMMIT_VERSION=vX.Y.Z`, or verify without installing via `--verify-only`.
+Installers verify the release SHA256 checksum before installing. Pin a version with `AI_COMMIT_VERSION=vX.Y.Z`, or verify without installing via `--verify-only`. Every release also ships a CycloneDX SBOM (`ai-commit-<platform>.bom.json`) and keyless SLSA build-provenance attestations (check with `gh attestation verify <file> -R kxng0109/ai-commit-cli`).
 
 **Linux/macOS:**
 ```bash

pom.xml

@@ -181,28 +181,10 @@
                     <imageName>ai-commit</imageName>
                     <mainClass>${main.class}</mainClass>
                     <buildArgs>
-                        <buildArg>-H:+UnlockExperimentalVMOptions</buildArg>
-                        <buildArg>-H:+RemoveUnusedSymbols</buildArg>
                         <buildArg>--no-fallback</buildArg>
-                        <buildArg>--enable-url-protocols=https,http</buildArg>
-                        <buildArg>--enable-https</buildArg>
                         <buildArg>-H:+ReportExceptionStackTraces</buildArg>
-
-                        <buildArg>-H:IncludeResources=.*\.properties$</buildArg>
-                        <buildArg>-H:IncludeResources=.*\.xml$</buildArg>
-                        <buildArg>-H:IncludeResources=.*\.json$</buildArg>
-                        <buildArg>-H:IncludeResources=META-INF/.*</buildArg>
-                        <buildArg>-H:IncludeResources=org/springframework/.*</buildArg>
-
-                        <buildArg>--initialize-at-build-time=org.slf4j,ch.qos.logback</buildArg>
                         <buildArg>--initialize-at-run-time=io.netty,reactor.netty</buildArg>
-
-                        <buildArg>-Ob</buildArg>
-                        <buildArg>--gc=serial</buildArg>
-                        <buildArg>-H:-UseServiceLoaderFeature</buildArg>
                         <buildArg>-march=compatibility</buildArg>
-
-                        <buildArg>--allow-incomplete-classpath</buildArg>
                     </buildArgs>
                 </configuration>
             </plugin>
@@ -262,6 +244,19 @@
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <groupId>org.cyclonedx</groupId>
+                <artifactId>cyclonedx-maven-plugin</artifactId>
+                <version>2.9.3</version>
+                <executions>
+                    <execution>
+                        <phase>verify</phase>
+                        <goals>
+                            <goal>makeAggregateBom</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
     </build>
 </project>

src/main/resources/META-INF/native-image/io.github.kxng0109/ai-commit-cli/reachability-metadata.json

@@ -928,6 +928,14 @@
       "allDeclaredConstructors": true,
       "allPublicConstructors": true
     },
+    {
+      "type": "sun.net.www.protocol.http.Handler",
+      "allDeclaredConstructors": true
+    },
+    {
+      "type": "sun.net.www.protocol.https.Handler",
+      "allDeclaredConstructors": true
+    },
     {
       "type": "org.slf4j.spi.LocationAwareLogger"
     },