scripts/vex (1)

24-27: Verify REVISION is available when PROJECT_TYPE == stable.

When PROJECT_TYPE is stable, the script uses $REVISION (line 26), but REVISION is not explicitly passed in the workflow step's env block (lines 168-173 in obs.yml). It is available as a workflow-level env var (line 28), so this should work — but it's worth noting the implicit dependency for clarity and consistency with the other env vars being explicitly passed.

Consider explicitly passing REVISION in the workflow step env

In .github/workflows/obs.yml, add REVISION to the vex step's env block for consistency:

       - run: scripts/vex
         if: ${{ inputs.skip-bundles == false && github.event_name != 'pull_request' }}
         env:
           ARCHIVE_PATH: ${{ needs.vars.outputs.archive_path }}
           COMMIT: ${{ needs.vars.outputs.commit }}
           GIT_ROOT: ${{ needs.vars.outputs.git_root }}
           PROJECT_TYPE: ${{ needs.vars.outputs.project_type }}
+          REVISION: ${{ inputs.revision || 'main' }}
           VERSION: ${{ needs.vars.outputs.version }}

scripts/sign-artifacts (1)

18-23: Glob may fail if no .openvex.json files exist.

This is a pre-existing pattern (same risk on lines 4 and 11), but worth noting: if the glob matches nothing, bash iterates with the literal string, and cosign will error out under set -e. Consider enabling nullglob at the top of the script so all three loops safely become no-ops when there are no matching files.

Suggested fix

 #!/usr/bin/env bash
 set -euo pipefail
+shopt -s nullglob
 
 for TARBALL in build/bundle/*.tar.gz; do

scripts/vex (1)

7-9: Quote variable expansions to prevent word splitting.

$COMMIT and $REVISION should be quoted for robustness, consistent with the quoted usage of $ARCHIVE_PATH on line 13.

Proposed fix

-ARCHIVE_ID=$COMMIT
+ARCHIVE_ID="$COMMIT"
 if [[ $PROJECT_TYPE == stable ]]; then
-    ARCHIVE_ID="$REVISION"
+    ARCHIVE_ID="$REVISION"
 fi

scripts/sign-artifacts (1)

19-25: Glob expansion into a scalar is fragile if multiple VEX files ever land in the directory.

echo build/bundle/*.openvex.json concatenates all matches into one string. If more than one .openvex.json file is present, $VEX becomes a space-separated list, [[ -e "$VEX" ]] will fail, and cosign sign-blob would receive a bad path. A for loop (matching the existing tarball/SBOM patterns) is more defensive and consistent:

Suggested change

-# Sign VEX file if available (not every release branch publishes one).
-VEX=$(echo build/bundle/*.openvex.json)
-if [[ -e "$VEX" ]]; then
-    cosign sign-blob -y "$VEX" \
-        --bundle "$VEX.bundle" \
-        --output-signature "$VEX.sig" \
-        --output-certificate "$VEX.cert"
-fi
+# Sign VEX files if available (not every release branch publishes one).
+for VEX in build/bundle/*.openvex.json; do
+    [[ -e "$VEX" ]] || continue
+    cosign sign-blob -y "$VEX" \
+        --bundle "$VEX.bundle" \
+        --output-signature "$VEX.sig" \
+        --output-certificate "$VEX.cert"
+done

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@scripts/sign-artifacts` around lines 19 - 25, The current VEX variable uses
echo on a glob (VEX=$(echo build/bundle/*.openvex.json)) which concatenates
matches into one scalar; replace that with an explicit loop: iterate over
build/bundle/*.openvex.json (for VEX in build/bundle/*.openvex.json; do ...
done), skip non-existing matches with a guard (e.g. [[ -e "$VEX" ]] ||
continue), and run the existing cosign sign-blob -y "$VEX" --bundle
"$VEX.bundle" --output-signature "$VEX.sig" --output-certificate "$VEX.cert" for
each file so multiple .openvex.json files are handled safely and consistently.