feat: enforce supply chain policy

server/security/test_supply_chain.py

@@ -0,0 +1,36 @@
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+
+ROOT = Path(__file__).parents[2]
+CHECKER = ROOT / "scripts" / "verify_supply_chain.py"
+
+
+class SupplyChainTest(unittest.TestCase):
+    def run_checker(self, *args):
+        return subprocess.run([sys.executable, str(CHECKER), *args], cwd=ROOT, text=True, capture_output=True)
+
+    def test_checked_in_references_are_digest_pinned(self):
+        result = self.run_checker()
+        self.assertEqual(result.returncode, 0, result.stderr)
+
+    def test_checker_rejects_tags_plaintext_secrets_and_template_release(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            dockerfile = root / "Dockerfile"
+            manifests = root / "manifests"
+            manifests.mkdir()
+            dockerfile.write_text("FROM example.invalid/game:latest\n")
+            (manifests / "bad.yaml").write_text("image: example.invalid/game@sha256:" + "0" * 64 + "\npassword: leaked\n")
+            result = self.run_checker("--dockerfile", str(dockerfile), "--manifest-dir", str(manifests), "--require-concrete")
+            self.assertNotEqual(result.returncode, 0)
+            self.assertIn("not digest-pinned", result.stderr)
+            self.assertIn("plaintext credential", result.stderr)
+            self.assertIn("not a release artifact", result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()