Fixing CIs

.github/workflows/integration-tests.yml

@@ -1,4 +1,4 @@
-name: Integration Tests for Exosphere
+name: Integration Tests
 
 on:
     push:
@@ -8,9 +8,21 @@ on:
           - 'state-manager/**'
           - 'python-sdk/**'
           - '.github/workflows/integration-tests.yml'
+    pull_request:
+        branches: [main]
+        paths:
+          - 'integration-tests/**' 
+          - 'state-manager/**'
+          - 'python-sdk/**'
+          - '.github/workflows/integration-tests.yml'
+
 
 jobs:
     test:
+        defaults:
+          run:
+            working-directory: integration-tests
+        if: github.repository == 'exospherehost/exospherehost'
         runs-on: ubuntu-latest
         services:
             mongodb:

.github/workflows/publish-python-sdk.yml

@@ -90,6 +90,64 @@ jobs:
           print(f'Version {version} is valid for PyPI publishing (contains beta indicator)')
           "
 
+      - name: Generate requirements file for SBOM
+        run: |
+          uv export --locked --format=requirements-txt --output-file=requirements.txt
+          echo "Generated requirements.txt for SBOM creation from lockfile"
+
+      - name: Install SBOM generation tools
+        run: |
+          uv tool install cyclonedx-bom
+          echo "Installed cyclonedx-bom version:"
+          uv tool run cyclonedx-bom --version
+          uv tool install pip-audit
+          echo "Installed pip-audit version:"
+          uv tool run pip-audit --version
+
+      - name: Generate SBOM with CycloneDX
+        run: |
+          uv tool run cyclonedx-py requirements --format json --output-file sbom-cyclonedx.json requirements.txt
+          echo "Generated CycloneDX SBOM in JSON format"
+
+      - name: Generate vulnerability report with pip-audit
+        run: |
+          uv tool run pip-audit --format json --output vulnerability-report.json --requirement requirements.txt || true
+          echo "Generated vulnerability report (non-blocking)"
+
       - run: uv build
 
-      - run: uv publish
+      - name: Publish to PyPI with provenance
+        run: |
+          # Get the current version
+          VERSION=$(uv run python -c "
+          import sys
+          sys.path.append('.')
+          from exospherehost._version import version
+          print(version)
+          ")
+
+          echo "Checking if exospherehost version $VERSION already exists on PyPI..."
+
+          # Query PyPI JSON API to check if version exists
+          HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" "https://pypi.org/pypi/exospherehost/$VERSION/json")
+
+          if [ "$HTTP_STATUS" = "200" ]; then
+            echo "Version $VERSION already exists on PyPI. Skipping publish."
+            exit 0
+          elif [ "$HTTP_STATUS" = "404" ]; then
+            echo "Version $VERSION not found on PyPI. Proceeding with publish."
+            uv publish --provenance
+          else
+            echo "Unexpected HTTP status $HTTP_STATUS when checking PyPI. Proceeding with publish."
+            uv publish --provenance
+          fi
+
+      - name: Upload SBOM artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-artifacts-beta-${{ github.sha }}
+          path: |
+            python-sdk/sbom-cyclonedx.json
+            python-sdk/requirements.txt
+            python-sdk/vulnerability-report.json
+          retention-days: 30

.github/workflows/release-python-sdk.yml

@@ -122,6 +122,73 @@ jobs:
           print(f'Version {version} is valid for release publishing')
           "
 
+      - name: Generate requirements file for SBOM
+        run: |
+          uv export --locked --format=requirements-txt --output-file=requirements.txt
+          echo "Generated requirements.txt for SBOM creation from lockfile"
+
+      - name: Install SBOM generation tools
+        run: |
+          uv tool install cyclonedx-bom
+          uv tool install pip-audit
+
+      - name: Generate SBOM with CycloneDX
+        run: |
+          uv tool run cyclonedx-py requirements --format json --output-file sbom-cyclonedx.json requirements.txt
+          uv tool run cyclonedx-py requirements --format xml --output-file sbom-cyclonedx.xml requirements.txt
+          echo "Generated CycloneDX SBOM in JSON and XML formats"
+
+      - name: Generate vulnerability report with pip-audit
+        run: |
+          uv tool run pip-audit --format json --output vulnerability-report.json --requirement requirements.txt || true
+          echo "Generated vulnerability report (non-blocking)"
+
+      - name: Create SBOM summary
+        run: |
+          echo "## Software Bill of Materials (SBOM)" > sbom-summary.md
+          echo "" >> sbom-summary.md
+          echo "This release includes the following supply chain security artifacts:" >> sbom-summary.md
+          echo "" >> sbom-summary.md
+          echo "- **Provenance**: Cryptographic proof of build integrity using GitHub's OIDC tokens" >> sbom-summary.md
+          echo "- **SBOM**: Complete dependency inventory in CycloneDX format" >> sbom-summary.md
+          echo "- **Vulnerability Report**: Security scan results for all dependencies" >> sbom-summary.md
+          echo "" >> sbom-summary.md
+          echo "### Dependencies Count:" >> sbom-summary.md
+          echo "- Direct dependencies: $(grep -c '^[^#]' requirements.txt || echo '0')" >> sbom-summary.md
+          echo "- Total dependencies (including transitive): $(wc -l < requirements.txt)" >> sbom-summary.md
+          echo "" >> sbom-summary.md
+          echo "### Verification:" >> sbom-summary.md
+          echo "You can verify this package's provenance on PyPI using:" >> sbom-summary.md
+          echo '```bash' >> sbom-summary.md
+          echo 'pip install sigstore' >> sbom-summary.md
+          echo 'python -m sigstore verify --bundle <bundle-file> exospherehost==${{ startsWith(github.ref_name, 'v') && substring(github.ref_name, 1) || github.ref_name }}' >> sbom-summary.md
+          echo '```' >> sbom-summary.md
+
       - run: uv build
 
-      - run: uv publish 
+      - name: Publish to PyPI with provenance
+        run: uv publish --provenance
+
+      - name: Upload SBOM artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-artifacts-${{ github.ref_name }}
+          path: |
+            python-sdk/sbom-cyclonedx.json
+            python-sdk/sbom-cyclonedx.xml
+            python-sdk/requirements.txt
+            python-sdk/vulnerability-report.json
+            python-sdk/sbom-summary.md
+          retention-days: 90
+
+      - name: Add SBOM to release assets
+        uses: softprops/action-gh-release@v2
+        if: startsWith(github.ref, 'refs/tags/')
+        with:
+          files: |
+            python-sdk/sbom-cyclonedx.json
+            python-sdk/sbom-cyclonedx.xml
+            python-sdk/sbom-summary.md
+            python-sdk/vulnerability-report.json
+          body_path: python-sdk/sbom-summary.md
+          append_body: true 

README.md

@@ -9,6 +9,7 @@
   <a href="https://github.com/orgs/exospherehost/packages?repo_name=exospherehost"><img src="https://img.shields.io/badge/Kubernetes-native-326ce5?logo=kubernetes&logoColor=white" alt="Kubernetes"></a>
   <a href="https://discord.com/invite/zT92CAgvkj"><img src="https://badgen.net/discord/members/zT92CAgvkj" alt="Discord"></a>
   <a href="https://github.com/exospherehost/exospherehost"><img src="https://img.shields.io/github/stars/exospherehost/exospherehost?style=social" alt="Stars"></a>
+  <a href="https://github.com/exospherehost/exospherehost/actions/workflows/integration-tests.yml?query=branch%3Amain"><img src="https://img.shields.io/github/actions/workflow/status/exospherehost/exospherehost/integration-tests.yml?branch=main" alt="Integration Tests (main)"></a>
 </p>
 
 ---

python-sdk/README.md

@@ -79,6 +79,50 @@ export EXOSPHERE_API_KEY="your-api-key"
 - **Scalability**: Designed for high-volume batch processing and workflows
 - **Graph Store (beta)**: Strings-only key-value store with per-run scope for sharing data across nodes (not durable across separate runs or clusters)
 
+## Supply Chain Security
+
+The ExosphereHost Python SDK includes comprehensive supply chain security features to ensure package integrity and transparency:
+
+### Package Provenance
+
+All releases are published with cryptographic provenance using GitHub's OIDC tokens and the Sigstore ecosystem. This provides:
+
+- **Cryptographic proof** that packages were built by the official ExosphereHost repository
+- **Tamper detection** to verify packages haven't been modified after publication
+- **Build transparency** showing exactly how and where packages were created
+
+### Software Bill of Materials (SBOM)
+
+Each release includes a complete Software Bill of Materials in industry-standard CycloneDX format:
+
+- **Complete dependency inventory** listing all direct and transitive dependencies
+- **Vulnerability scanning** results for all dependencies
+- **License compliance** information for enterprise environments
+- **Version tracking** for security auditing and compliance
+
+### Verification
+
+You can verify the authenticity of any ExosphereHost package:
+
+```bash
+# Install verification tools
+pip install sigstore
+
+# Verify package provenance (replace X.Y.Z with actual version)
+python -m sigstore verify --bundle <bundle-file> exospherehost==X.Y.Z
+```
+
+### Security Artifacts
+
+For each release, you can find the following security artifacts:
+
+- **SBOM files** (JSON and XML formats) attached to GitHub releases
+- **Vulnerability reports** showing security scan results
+- **Provenance attestations** available on PyPI
+- **Build logs** publicly available in GitHub Actions
+
+These features align with modern software supply chain security best practices and help meet enterprise security requirements.
+
 ## Architecture
 
 The SDK is built around two core concepts: