This repository publishes containers with a supply-chain trail designed for HPC usage:

1. Recipes are linted for metadata and reproducibility policy.
2. Containers are built in GitHub Actions.
3. SBOMs are generated with Syft.
4. Vulnerabilities are scanned with Grype.
5. Published artifacts are signed with Cosign.
6. The published image is pulled back from GHCR and verified.

Pull the container:

apptainer pull bwa.sif oras://ghcr.io/brucemoran/singularity/bwa--0-7-17:latest

Verify the image signature against GitHub Actions OIDC identities:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'https://github.com/brucemoran/Singularity/.github/workflows/publish.yml@.*' \
  ghcr.io/brucemoran/singularity/bwa--0-7-17:latest

Inspect embedded metadata:

apptainer inspect bwa.sif
apptainer sif list bwa.sif

Each publish job emits a provenance JSON artifact that records:

• Recipe path
• Tool name and version
• Published image reference
• Git commit SHA
• GitHub workflow run metadata

This provenance bundle is stored as a workflow artifact and can be attached to downstream release processes.

The security scan workflow produces:

• CycloneDX JSON SBOM
• SPDX JSON SBOM
• Grype human-readable report
• SARIF upload to the GitHub Security tab

These artifacts help cluster administrators and end users audit dependencies before promoting an image into production module trees.

For HPC environments:

1. Verify signature on the published GHCR image.
2. Review the SBOM and CVE reports for the release.
3. Mirror the approved image into a local site registry or cache.
4. Expose the image to users via generated modulefiles under modules/.