release: attest exact sealed SBOM evidence

.github/workflows/exact-artifact-sbom-attestation-quality.yml

@@ -0,0 +1,119 @@
+name: Exact Artifact SBOM Attestation Quality
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - ".github/workflows/exact-artifact-sbom-attestation.yml"
+      - ".github/workflows/exact-artifact-sbom-attestation-quality.yml"
+      - "scripts/ci/verify_exact_artifact_sbom_handoff.py"
+      - "tests/test_exact_artifact_sbom_attestation_contract.py"
+      - "tests/test_exact_artifact_sbom_review_regressions.py"
+      - "tests/test_verify_exact_artifact_sbom_handoff.py"
+      - "docs/doctoring/exact-artifact-sbom-attestation.md"
+      - "CHANGELOG.md"
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/exact-artifact-sbom-attestation.yml"
+      - ".github/workflows/exact-artifact-sbom-attestation-quality.yml"
+      - "scripts/ci/verify_exact_artifact_sbom_handoff.py"
+      - "tests/test_exact_artifact_sbom_attestation_contract.py"
+      - "tests/test_exact_artifact_sbom_review_regressions.py"
+      - "tests/test_verify_exact_artifact_sbom_handoff.py"
+      - "docs/doctoring/exact-artifact-sbom-attestation.md"
+      - "CHANGELOG.md"
+
+concurrency:
+  group: exact-artifact-sbom-attestation-quality-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  minimum-python-contract:
+    name: Python 3.10 contract
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact contributor head
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Verify exact workflow source checkout
+        env:
+          EXPECTED_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: test "$(git rev-parse HEAD)" = "$EXPECTED_SOURCE_SHA"
+
+      - name: Set up minimum supported Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.10"
+
+      - name: Compile production and contracts on Python 3.10
+        run: |
+          python -m compileall -q \
+            scripts/ci/verify_exact_artifact_sbom_handoff.py \
+            tests/test_exact_artifact_sbom_attestation_contract.py \
+            tests/test_exact_artifact_sbom_review_regressions.py \
+            tests/test_verify_exact_artifact_sbom_handoff.py
+
+  exact-contract:
+    name: Python 3.14 exact contract and complete coverage
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout exact contributor head
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Verify exact workflow source checkout
+        env:
+          EXPECTED_SOURCE_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: test "$(git rev-parse HEAD)" = "$EXPECTED_SOURCE_SHA"
+
+      - name: Set up current stable Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: "3.14"
+          cache: pip
+          cache-dependency-path: requirements-opencode-review-ci-hashes.txt
+
+      - name: Install hash-locked quality tooling
+        run: python -m pip install --disable-pip-version-check --require-hashes -r requirements-opencode-review-ci-hashes.txt
+
+      - name: Run exact contracts with complete verifier branch coverage
+        run: |
+          python -m coverage erase
+          python -m coverage run --branch -m pytest -q \
+            tests/test_exact_artifact_sbom_attestation_contract.py \
+            tests/test_exact_artifact_sbom_review_regressions.py \
+            tests/test_verify_exact_artifact_sbom_handoff.py
+          python -m coverage report \
+            --include=scripts/ci/verify_exact_artifact_sbom_handoff.py \
+            --show-missing \
+            --fail-under=100
+          python -m interrogate --fail-under=100 scripts/ci/verify_exact_artifact_sbom_handoff.py
+
+      - name: Compile production and contract files
+        run: |
+          python -m compileall -q \
+            scripts/ci/verify_exact_artifact_sbom_handoff.py \
+            tests/test_exact_artifact_sbom_attestation_contract.py \
+            tests/test_exact_artifact_sbom_review_regressions.py \
+            tests/test_verify_exact_artifact_sbom_handoff.py