Launch

.github/actionlint.yaml

@@ -2,3 +2,4 @@ self-hosted-runner:
   labels:
     - icon-editor-windows
     - self-hosted-windows-lv
+    - ubuntu-24.04

.github/pull_request_template.md

@@ -0,0 +1,8 @@
+## Summary
+- 
+
+## Requirement(s)
+- REQ-
+
+## Testing
+- [ ] `npm test`

.github/workflows/add-token-to-labview-self-hosted.yml

@@ -7,15 +7,15 @@ jobs:
   add-token:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - name: Run add-token-to-labview action
         uses: ./add-token-to-labview/action.yml
         with:
           minimum_supported_lv_version: '2021'
           supported_bitness: '64'
           relative_path: 'scripts/add-token-to-labview'
       - name: Upload token artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: token-artifact
           path: 'scripts/add-token-to-labview/LabVIEW.ini'

.github/workflows/apply-vipc-self-hosted.yml

@@ -7,7 +7,7 @@ jobs:
   apply-vipc:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - name: Run apply-vipc action (dry_run=true)
         uses: ./apply-vipc/action.yml
         with:

.github/workflows/build-lvlibp-self-hosted.json

@@ -31,7 +31,7 @@
           "uses": "actions/upload-artifact@v4",
           "with": {
             "name": "build-lvlibp-artifact",
-            "path": "scripts/build-lvlibp/lv_icon.lvlibp"
+            "path": "scripts/build-lvlibp/lv_icon_x64_v1.0.0.1+gabcdef.lvlibp"
           }
         }
       ]

.github/workflows/build-lvlibp-self-hosted.yml

@@ -7,7 +7,7 @@ jobs:
   build-lvlibp:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - name: Run build-lvlibp action
         uses: ./build-lvlibp/action.yml
         with:
@@ -22,7 +22,11 @@ jobs:
           build: '1'
           commit: 'abcdef'
       - name: Upload lvlibp artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: build-lvlibp-artifact
-          path: 'scripts/build-lvlibp/lv_icon.lvlibp'
+          path: 'scripts/build-lvlibp/lv_icon_x64_v1.0.0.1+gabcdef.lvlibp'
+      - name: Generate SLSA provenance
+        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018
+        with:
+          subject-path: 'scripts/build-lvlibp/lv_icon_x64_v1.0.0.1+gabcdef.lvlibp'

.github/workflows/build-self-hosted.json

@@ -6,6 +6,11 @@
   "jobs": {
     "build": {
       "runs-on": "ubuntu-latest",
+      "env": {
+        "MAJOR": "1",
+        "MINOR": "0",
+        "PATCH": "0"
+      },
       "steps": [
         {
           "uses": "actions/checkout@v4"
@@ -15,22 +20,35 @@
           "uses": "./build/action.yml",
           "with": {
             "relative_path": "scripts/build",
-            "major": "1",
-            "minor": "0",
-            "patch": "0",
-            "build": "1",
-            "commit": "abcdef",
+            "major": "${{ env.MAJOR }}",
+            "minor": "${{ env.MINOR }}",
+            "patch": "${{ env.PATCH }}",
+            "build": "${{ github.run_number }}",
+            "commit": "${{ github.sha }}",
             "labview_minor_revision": "3",
             "company_name": "Acme Corp",
             "author_name": "Jane Doe"
           }
         },
+        {
+          "name": "Record artifact metadata",
+          "id": "record",
+          "run": "VERSION=\"${MAJOR}.${MINOR}.${PATCH}.${GITHUB_RUN_NUMBER}\"\nSHORT_SHA=\"${GITHUB_SHA::7}\"\nARTIFACT=\"lv_icon_x64_v${VERSION}+${SHORT_SHA}.lvlibp\"\nmv scripts/build/lv_icon_x64.lvlibp \"scripts/build/${ARTIFACT}\"\nprintf '{\"commit\":\"%s\",\"build_number\":\"%s\",\"artifacts\":[\"%s\"]}' \"$GITHUB_SHA\" \"$GITHUB_RUN_NUMBER\" \"$ARTIFACT\" > scripts/build/artifact-manifest.json\necho \"artifact=${ARTIFACT}\" >> \"$GITHUB_OUTPUT\""
+        },
         {
           "name": "Upload build artifact",
           "uses": "actions/upload-artifact@v4",
           "with": {
-            "name": "build-artifact",
-            "path": "scripts/build/lv_icon_x64.lvlibp"
+            "name": "${{ steps.record.outputs.artifact }}",
+            "path": "scripts/build/${{ steps.record.outputs.artifact }}"
+          }
+        },
+        {
+          "name": "Upload artifact manifest",
+          "uses": "actions/upload-artifact@v4",
+          "with": {
+            "name": "artifact-manifest",
+            "path": "scripts/build/artifact-manifest.json"
           }
         }
       ]

.github/workflows/build-self-hosted.yml

@@ -6,22 +6,44 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    env:
+      MAJOR: '1'
+      MINOR: '0'
+      PATCH: '0'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - name: Run build action
         uses: ./build/action.yml
         with:
           relative_path: 'scripts/build'
-          major: '1'
-          minor: '0'
-          patch: '0'
-          build: '1'
-          commit: 'abcdef'
+          major: ${{ env.MAJOR }}
+          minor: ${{ env.MINOR }}
+          patch: ${{ env.PATCH }}
+          build: ${{ github.run_number }}
+          commit: ${{ github.sha }}
           labview_minor_revision: '3'
           company_name: 'Acme Corp'
           author_name: 'Jane Doe'
+      - name: Record artifact metadata
+        id: record
+        run: |
+          VERSION="${MAJOR}.${MINOR}.${PATCH}.${GITHUB_RUN_NUMBER}"
+          SHORT_SHA="${GITHUB_SHA::7}"
+          ARTIFACT="lv_icon_x64_v${VERSION}+${SHORT_SHA}.lvlibp"
+          mv scripts/build/lv_icon_x64.lvlibp "scripts/build/${ARTIFACT}"
+          printf '{"commit":"%s","build_number":"%s","artifacts":["%s"]}' "$GITHUB_SHA" "$GITHUB_RUN_NUMBER" "$ARTIFACT" > scripts/build/artifact-manifest.json
+          echo "artifact=${ARTIFACT}" >> "$GITHUB_OUTPUT"
       - name: Upload build artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
-          name: build-artifact
-          path: 'scripts/build/lv_icon_x64.lvlibp'
+          name: ${{ steps.record.outputs.artifact }}
+          path: scripts/build/${{ steps.record.outputs.artifact }}
+      - name: Upload artifact manifest
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: artifact-manifest
+          path: scripts/build/artifact-manifest.json
+      - name: Generate SLSA provenance
+        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018
+        with:
+          subject-path: scripts/build/${{ steps.record.outputs.artifact }}

.github/workflows/build-vi-package-self-hosted.json

@@ -32,7 +32,7 @@
           "uses": "actions/upload-artifact@v4",
           "with": {
             "name": "vi-package",
-            "path": "scripts/build-vi-package/lv_icon.vip"
+            "path": "scripts/build-vi-package/lv_icon_v1.0.0.1+gabcdef.vip"
           }
         }
       ]

.github/workflows/build-vi-package-self-hosted.yml

@@ -7,7 +7,7 @@ jobs:
   build-vi-package:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
       - name: Run build-vi-package action
         uses: ./build-vi-package/action.yml
         with:
@@ -23,7 +23,11 @@ jobs:
           commit: 'abcdef'
           display_information_json: '{"Name":"Test"}'
       - name: Upload VI package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: vi-package
-          path: 'scripts/build-vi-package/lv_icon.vip'
+          path: 'scripts/build-vi-package/lv_icon_v1.0.0.1+gabcdef.vip'
+      - name: Generate SLSA provenance
+        uses: actions/attest-build-provenance@ef244123eb79f2f7a7e75d99086184180e6d0018
+        with:
+          subject-path: 'scripts/build-vi-package/lv_icon_v1.0.0.1+gabcdef.vip'

.github/workflows/ci.json

@@ -13,73 +13,61 @@
     }
   },
   "jobs": {
-    "node-ci": {
+    "release-check": {
       "runs-on": "ubuntu-24.04",
-      "env": {
-        "ARTIFACT_DIR": "artifacts/linux"
+      "outputs": {
+        "needs_release": "${{ steps.check.outputs.present }}"
       },
       "steps": [
         {
           "uses": "actions/checkout@v4"
         },
         {
-          "uses": "actions/setup-node@v4",
+          "id": "check",
+          "run": "if [[ -f release.json ]]; then\n  echo 'present=true' >> \"$GITHUB_OUTPUT\"\nelse\n  echo 'present=false' >> \"$GITHUB_OUTPUT\"\nfi"
+        },
+        {
+          "uses": "actions/upload-artifact@v4",
+          "if": "steps.check.outputs.present == 'true'",
           "with": {
-            "node-version": 24
+            "name": "release-metadata",
+            "path": "release.json"
           }
+        }
+      ]
+    },
+    "validate-artifacts": {
+      "needs": "release-check",
+      "runs-on": "ubuntu-24.04",
+      "steps": [
+        {
+          "uses": "actions/checkout@v4"
         },
         {
-          "run": "npm run check:node"
+          "uses": "actions/setup-node@v4",
+          "with": {
+            "node-version": 24
+          }
         },
         {
           "run": "npm install"
         },
         {
           "run": "npm run link:check"
         },
-        {
-          "run": "npm run test:ci"
-        },
         {
           "run": "npm run derive:registry"
         },
         {
-          "run": "rm -rf artifacts"
-        },
-        {
-          "run": "npm run generate:summary",
-          "env": {
-            "TEST_RESULTS_GLOBS": "test-results/*junit*.xml"
-          }
-        },
-        {
-          "uses": "actions/upload-artifact@v4",
-          "if": "always()",
-          "with": {
-            "name": "traceability",
-            "path": "${{ env.ARTIFACT_DIR }}/traceability.*"
-          }
+          "run": "git diff --exit-code -- dispatchers.json"
         },
         {
-          "uses": "actions/upload-artifact@v4",
-          "if": "always()",
-          "with": {
-            "name": "action-docs",
-            "path": "${{ env.ARTIFACT_DIR }}/action-docs.*"
-          }
-        },
-        {
-          "uses": "actions/upload-artifact@v4",
-          "if": "always()",
-          "with": {
-            "name": "evidence",
-            "path": "${{ env.ARTIFACT_DIR }}/evidence/**",
-            "if-no-files-found": "ignore"
-          }
+          "run": "npm run check:traceability"
         }
       ]
     },
     "ps-ci": {
+      "needs": "release-check",
       "strategy": {
         "matrix": {
           "include": [
@@ -115,19 +103,6 @@
           "shell": "pwsh",
           "run": "$required = [Version]'7.5.1'\nif ($PSVersionTable.PSVersion -lt $required) {\n  $msiUrl = 'https://github.com/PowerShell/PowerShell/releases/download/v7.5.1/PowerShell-7.5.1-win-x64.msi'\n  $msiPath = Join-Path $env:RUNNER_TEMP 'PowerShell-7.5.1-win-x64.msi'\n  Invoke-WebRequest -Uri $msiUrl -OutFile $msiPath\n  $expectedHash = 'b110eccaf55bb53ae5e6b6de478587ed8203570b0bda9bd374a0998e24d4033a'\n  $actualHash = (Get-FileHash $msiPath -Algorithm SHA256).Hash\n  if ($actualHash -ne $expectedHash) {\n    throw \"SHA256 mismatch: $actualHash\"\n  }\n  Start-Process msiexec -Wait -ArgumentList '/i', $msiPath, '/qn', 'ADD_PATH=1'\n}\n$version = (pwsh --version).Trim() -replace '^PowerShell '\nif ([Version]$version -lt $required) {\n  throw \"PowerShell version $version is less than $required\"\n}\n"
         },
-        {
-          "name": "Capture setup info",
-          "shell": "pwsh",
-          "run": "$data = [ordered]@{\n  'Current runner version' = $env:RUNNER_VERSION\n  'Runner Image'          = $env:ImageOS\n  'ImageVersion'          = $env:ImageVersion\n  'RUNNER_NAME'           = $env:RUNNER_NAME\n  'RUNNER_OS'             = $env:RUNNER_OS\n  'RUNNER_ARCH'           = $env:RUNNER_ARCH\n}\n$file = \"setup-info-${{ matrix.os }}-${{ matrix.runner_type }}.md\"\n\"was captured from the set up job.\" | Out-File -FilePath $file -Encoding utf8\nforeach ($k in $data.Keys) {\n  if ($data[$k]) {\n    \"${k}: $($data[$k])\" | Out-File -FilePath $file -Encoding utf8 -Append\n  }\n}\n"
-        },
-        {
-          "uses": "actions/upload-artifact@v4",
-          "if": "always()",
-          "with": {
-            "name": "setup-info-${{ matrix.os }}-${{ matrix.runner_type }}",
-            "path": "setup-info-${{ matrix.os }}-${{ matrix.runner_type }}.md"
-          }
-        },
         {
           "name": "Install Pester",
           "shell": "pwsh",
@@ -156,7 +131,7 @@
     },
     "report": {
       "needs": [
-        "node-ci",
+        "validate-artifacts",
         "ps-ci"
       ],
       "runs-on": "ubuntu-24.04",
@@ -177,13 +152,11 @@
         {
           "run": "npm install"
         },
-        {
-          "run": "rm -rf artifacts"
-        },
         {
           "uses": "actions/download-artifact@v4",
           "with": {
-            "path": "./artifacts"
+            "pattern": "pester-junit-*",
+            "path": "./downloaded-artifacts"
           }
         },
         {
@@ -192,12 +165,26 @@
         {
           "run": "npm run generate:summary",
           "env": {
-            "TEST_RESULTS_GLOBS": "artifacts/test-results/**/*junit*.xml\nartifacts/pester-junit-*/pester-junit.xml\n",
+            "TEST_RESULTS_GLOBS": "test-results/*junit*.xml\ndownloaded-artifacts/pester-junit-*/pester-junit.xml\n",
             "REQ_MAPPING_FILE": "requirements.json",
             "DISPATCHER_REGISTRY": "dispatchers.json",
             "EVIDENCE_DIR": "artifacts/evidence"
           }
         },
+        {
+          "run": "npx tsx scripts/generate-traceability-matrix.ts"
+        },
+        {
+          "run": "cat artifacts/linux/traceability-matrix.md >> \"$GITHUB_STEP_SUMMARY\""
+        },
+        {
+          "uses": "actions/upload-artifact@v4",
+          "if": "(success() || failure()) && !cancelled()",
+          "with": {
+            "name": "traceability-matrix",
+            "path": "artifacts/linux/traceability-matrix.md"
+          }
+        },
         {
           "run": "npx tsx scripts/print-pester-traceability.ts >> \"$GITHUB_STEP_SUMMARY\""
         }