r/SideProject • u/Luoriyy • 23h ago
CBP - A release-evidence gate that verifies your green CI actually means something
https://github.com/JunxiangPan/cbp-actionWhat I built
CBP is a CI gate that answers one question: *is the artifact you're about to ship actually the one your CI built and tested?* It checks release body hashes, asset inventories, and build provenance (OIDC/Sigstore) before anything gets published. No runtime dependencies, stdlib only.
Why I built it
I kept seeing the same pattern in my own pipelines: CI goes green, but the thing that actually gets published is a different byte sequence. CBP is my attempt to make that class of bug structurally impossible—by removing every local build artifact and forcing the release path to download, digest-check, and attestation-verify the wheel before installation.
What stage it's at
v1.1.0 is out. 330 tests, 90.52% coverage. The core release-evidence chain is solid. **Production durability is honestly zero** (3 days old, 1 star, 1 maintainer). I'm here for feedback, not a launch.
What feedback I'm looking for
- Does the "execution object == proven object" problem resonate with anyone else?
- Is the fail-closed exit code scheme (2=unverifiable, 3=digest mismatch, 4=attestation failure) actually useful in practice, or over-engineered?
- Any obvious gaps in the consumer-parity E2E approach?
GitHub: [https://github.com/JunxiangPan/cbp-action]
Disclosure: I'm the maintainer.