[v2.3][CI] Stabilize supply-chain triggers + action versions

.github/workflows/slsa-source-provenance.yml

@@ -1,6 +1,27 @@
 name: SLSA Provenance (Source)
 
 on:
+  push:
+    branches:
+      - master
+      - release/**
+    paths:
+      - .github/workflows/slsa-source-provenance.yml
+      - .github/workflows/supply-chain.yml
+      - docker-compose.yml
+      - infrastructure/**
+      - src/**
+      - third_party/**
+  pull_request:
+    branches:
+      - master
+    paths:
+      - .github/workflows/slsa-source-provenance.yml
+      - .github/workflows/supply-chain.yml
+      - docker-compose.yml
+      - infrastructure/**
+      - src/**
+      - third_party/**
   workflow_dispatch:
 
 permissions:

.github/workflows/supply-chain.yml

@@ -1,6 +1,37 @@
 name: Supply Chain (SBOM + Cosign + SLSA)
 
 on:
+  push:
+    branches:
+      - master
+      - release/**
+    paths:
+      - .github/workflows/supply-chain.yml
+      - .github/workflows/slsa-source-provenance.yml
+      - docker-compose.yml
+      - infrastructure/**
+      - src/db/**
+      - src/services/core-dotnet/**
+      - src/services/ai-engine/**
+      - src/services/agent-cpp/**
+      - src/shared/protos/**
+      - src/web/dashboard/**
+      - third_party/**
+  pull_request:
+    branches:
+      - master
+    paths:
+      - .github/workflows/supply-chain.yml
+      - .github/workflows/slsa-source-provenance.yml
+      - docker-compose.yml
+      - infrastructure/**
+      - src/db/**
+      - src/services/core-dotnet/**
+      - src/services/ai-engine/**
+      - src/services/agent-cpp/**
+      - src/shared/protos/**
+      - src/web/dashboard/**
+      - third_party/**
   workflow_dispatch:
 
 permissions:
@@ -56,7 +87,7 @@ jobs:
           echo "labels=" >> "$GITHUB_OUTPUT"
       - name: Build and push
         id: build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./src/services/core-dotnet/AetherGuard.Core/Dockerfile
@@ -66,7 +97,7 @@ jobs:
           labels: ${{ github.actor == 'nektos/act' && steps.meta-local.outputs.labels || steps.meta.outputs.labels }}
       - name: Generate SBOM
         if: ${{ github.actor != 'nektos/act' }}
-        uses: anchore/sbom-action@v0
+        uses: anchore/sbom-action@v0.22.2
         with:
           image: ${{ steps.image-vars.outputs.image_base }}/core-service@${{ steps.build.outputs.digest }}
           registry-username: ${{ github.actor }}
@@ -81,7 +112,7 @@ jobs:
           path: sbom-core.spdx.json
       - name: Install cosign
         if: ${{ github.actor != 'nektos/act' }}
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@v4
       - name: Sign image
         if: ${{ github.actor != 'nektos/act' }}
         env:
@@ -148,7 +179,7 @@ jobs:
           echo "labels=" >> "$GITHUB_OUTPUT"
       - name: Build and push
         id: build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: ./src/services/ai-engine
           file: ./src/services/ai-engine/Dockerfile
@@ -158,7 +189,7 @@ jobs:
           labels: ${{ github.actor == 'nektos/act' && steps.meta-local.outputs.labels || steps.meta.outputs.labels }}
       - name: Generate SBOM
         if: ${{ github.actor != 'nektos/act' }}
-        uses: anchore/sbom-action@v0
+        uses: anchore/sbom-action@v0.22.2
         with:
           image: ${{ steps.image-vars.outputs.image_base }}/ai-service@${{ steps.build.outputs.digest }}
           registry-username: ${{ github.actor }}
@@ -173,7 +204,7 @@ jobs:
           path: sbom-ai.spdx.json
       - name: Install cosign
         if: ${{ github.actor != 'nektos/act' }}
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@v4
       - name: Sign image
         if: ${{ github.actor != 'nektos/act' }}
         env:
@@ -240,7 +271,7 @@ jobs:
           echo "labels=" >> "$GITHUB_OUTPUT"
       - name: Build and push
         id: build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: ./src/web/dashboard
           file: ./src/web/dashboard/Dockerfile
@@ -250,7 +281,7 @@ jobs:
           labels: ${{ github.actor == 'nektos/act' && steps.meta-local.outputs.labels || steps.meta.outputs.labels }}
       - name: Generate SBOM
         if: ${{ github.actor != 'nektos/act' }}
-        uses: anchore/sbom-action@v0
+        uses: anchore/sbom-action@v0.22.2
         with:
           image: ${{ steps.image-vars.outputs.image_base }}/web-service@${{ steps.build.outputs.digest }}
           registry-username: ${{ github.actor }}
@@ -265,7 +296,7 @@ jobs:
           path: sbom-web.spdx.json
       - name: Install cosign
         if: ${{ github.actor != 'nektos/act' }}
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@v4
       - name: Sign image
         if: ${{ github.actor != 'nektos/act' }}
         env:
@@ -332,7 +363,7 @@ jobs:
           echo "labels=" >> "$GITHUB_OUTPUT"
       - name: Build and push
         id: build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
           context: .
           file: ./src/services/agent-cpp/Dockerfile
@@ -342,7 +373,7 @@ jobs:
           labels: ${{ github.actor == 'nektos/act' && steps.meta-local.outputs.labels || steps.meta.outputs.labels }}
       - name: Generate SBOM
         if: ${{ github.actor != 'nektos/act' }}
-        uses: anchore/sbom-action@v0
+        uses: anchore/sbom-action@v0.22.2
         with:
           image: ${{ steps.image-vars.outputs.image_base }}/agent-service@${{ steps.build.outputs.digest }}
           registry-username: ${{ github.actor }}
@@ -357,7 +388,7 @@ jobs:
           path: sbom-agent.spdx.json
       - name: Install cosign
         if: ${{ github.actor != 'nektos/act' }}
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@v4
       - name: Sign image
         if: ${{ github.actor != 'nektos/act' }}
         env:

CHANGELOG.md

@@ -29,6 +29,7 @@ Semantic Versioning.
 - Agent now injects W3C trace headers for HTTP requests.
 - Dashboard dependencies updated to Next.js 16.1.6.
 - Core external-signal ingestion now prefers batch enrichment and falls back to per-item enrichment.
+- CI supply-chain workflows now use path-filtered push/PR triggers and refreshed action versions.
 
 ### Deprecated
 - 

README.md

@@ -209,6 +209,7 @@ Open the dashboard at http://localhost:3000.
 - v2.3 M3 canary evaluator script: scripts/qa/README.md
 - v2.3 M4 dynamic risk allocation (core): docs/Core-Dynamic-Risk-v2.3-M4.md
 - v2.3 M4 dashboard explainability: docs/Web-Explainability-v2.3-M4.md
+- v2.3 CI / supply-chain stabilization: docs/CI-SupplyChain-Stabilization-v2.3.md
 - v2.3 release notes: docs/Release-Notes-v2.3.md
 - v2.3 PR acceptance template: docs/PR-Template-v2.3-Acceptance.md
 

docs/CI-SupplyChain-Stabilization-v2.3.md

@@ -0,0 +1,43 @@
+# v2.3 CI / Supply Chain Stabilization
+
+Epic: #14  
+Issues: #46, #47
+
+## Goal
+
+Stabilize heavy supply-chain workflows so they run only when relevant and remain compatible with current GitHub Actions ecosystem.
+
+## What Changed
+
+### Trigger policy
+
+Both workflows now support:
+
+- `workflow_dispatch` (manual release builds)
+- `push` (only `master` and `release/**` with path filters)
+- `pull_request` (to `master` with the same path filters)
+
+This avoids running heavy image/provenance jobs for unrelated edits.
+
+### Supply-chain hardening
+
+Updated key actions in `supply-chain.yml`:
+
+- `docker/build-push-action` -> `v6`
+- `anchore/sbom-action` -> `v0.22.2`
+- `sigstore/cosign-installer` -> `v4`
+
+SLSA reusable workflows stay on latest upstream release (`v2.1.0`).
+
+## Acceptance Mapping
+
+### #46
+
+- paths filters applied: **Done**
+- manual `workflow_dispatch` retained: **Done**
+
+### #47
+
+- SLSA permissions path preserved for reusable generators: **Done**
+- SBOM generation action upgraded/pinned to current release: **Done**
+- no deprecated action references in supply-chain workflow: **Done**

docs/Release-Notes-v2.3.md

@@ -64,6 +64,4 @@ v2.3 upgrades Aether-Guard from static/reactive risk handling to a predictive mu
 
 ## Known Follow-ups
 
-- `#48` v2.3 release criteria checklist (open)
-- `#14` CI / supply-chain stabilization epic (open)
 - `#8` course/project management epic (open)