SLSA等级门禁与构建来源治理（Level1-4-策略）最佳实践

实现示例type Attestation = { level: 1 | 2 | 3 | 4; builderId: string; materials: string[]; provenance?: string } function validBuilder(id: string): boolean { return /^https:\/\/[A-Za-z0-9_.\-]+\/[A-Za-z0-9_.\-]+$/.test(id) } function meets(a: Attestation, required: 1 | 2 | 3 | 4): boolean { if (!validBuilder(a.builderId)) return false if (a.level < required) return false if (required >= 3 && (!a.provenance || a.materials.length === 0)) return false return true } function gate(a: Attestation, required: 1 | 2 | 3 | 4): { ok: boolean; errors: string[] } { const errors: string[] = [] if (!meets(a, required)) errors.push('slsa-level') return { ok: errors.length === 0, errors } } 审计与发布治理审计构建等级与来源；未达标阻断并提供达标清单与步骤建议。等级策略变更需审批与归档。