feat(lab8): cosign signing, tamper demo, sbom attestation

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,21 @@
+## Goal
+
+<!-- State the goal of this lab in one sentence. -->
+
+## Changes
+
+<!-- List the changes as bullet points. -->
+
+## Testing
+
+<!-- Include the commands you ran and their actual observed output. -->
+
+## Artifacts & Screenshots
+
+<!-- Link the submission report, relevant artifacts, and screenshots. -->
+
+## Checklist
+
+- [ ] The title follows `feat(labN): <topic>`.
+- [ ] No secrets or large temporary files are committed.
+- [ ] `submissions/labN.md` exists for this lab.

.github/workflows/lab1-smoke.yml

@@ -0,0 +1,45 @@
+name: Lab 1 - Juice Shop smoke test
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Start Juice Shop
+        run: docker run -d --name juice-shop -p 127.0.0.1:3000:3000 bkimminich/juice-shop:v20.0.0
+
+      - name: Wait up to 60 seconds for HTTP 200
+        shell: bash
+        run: |
+          deadline=$((SECONDS + 60))
+          while (( SECONDS < deadline )); do
+            remaining=$((deadline - SECONDS))
+            if status=$(curl --silent --fail --max-time "$remaining" \
+              --output /tmp/juice-shop-version.json --write-out '%{http_code}' \
+              http://localhost:3000/rest/admin/application-version); then
+              if [[ "$status" == "200" ]]; then
+                printf 'HTTP %s\n' "$status"
+                cat /tmp/juice-shop-version.json
+                printf '\nReady after %s seconds\n' "$SECONDS"
+                exit 0
+              fi
+            fi
+            if (( SECONDS < deadline )); then sleep 1; fi
+          done
+          echo 'Juice Shop did not return HTTP 200 within 60 seconds.' >&2
+          exit 1
+
+      - name: Show container logs on failure
+        if: failure()
+        run: docker logs juice-shop
+
+      - name: Stop the container
+        if: always()
+        run: docker stop juice-shop

.gitignore

@@ -9,6 +9,8 @@ refs/
 # These are large + regenerated each run; not student deliverables.
 labs/lab2/output/
 labs/lab2/output-*/
+labs/lab4/grype-from-sbom.*
+labs/lab4/trivy.json
 labs/lab5/results/
 labs/lab5/semgrep/juice-shop/
 labs/lab6/results/

.pre-commit-config.yaml

@@ -0,0 +1,12 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: detect-private-key
+      - id: check-added-large-files
+        # Lab 4 requires committing these generated SBOM/attestation artifacts.
+        exclude: ^labs/lab4/juice-shop\.(cdx|spdx)\.json$|^labs/lab4/juice-shop-attestation\.json$