From 4da0f6cfe1957a7594ca907c1eff3c8e9b6aba1c Mon Sep 17 00:00:00 2001 From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 25 Jun 2026 09:11:49 +0100 Subject: [PATCH] feat(ci): attest build provenance Add actions/attest-build-provenance (pinned @e8998f9 # v2) to the release job, attesting the same artifacts uploaded by softprops/action-gh-release. Grants id-token: write and attestations: write on that job. Attested paths: artifacts/gsa-linux-x86_64.tar.gz Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f42f24c..8bc7fe7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -95,6 +95,8 @@ jobs: timeout-minutes: 30 permissions: contents: write + id-token: write + attestations: write steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -115,6 +117,12 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Attest build provenance + uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2 + with: + subject-path: | + artifacts/gsa-linux-x86_64.tar.gz + provenance: name: SLSA Provenance needs: [build]