[bloogefest]

What and why

Releases had no assets, so OpenSSF Scorecard reported Signed-Releases as inconclusive and consumers could not verify what a release contains.

A new provenance job runs after release-please when a release is created:

• git archive of the release tag as <repo>-<version>.tar.gz and SHA256SUMS;
• actions/attest creates signed SLSA build provenance (Sigstore, stored in GitHub artifact attestations);
• the Sigstore bundle (*.sigstore.json) and its in-toto DSSE envelope (*.intoto.jsonl) are uploaded to the release with a sogeor-release-bot token scoped to the repository and contents: write.

GITHUB_TOKEN gets only attestations: write, contents: read and id-token: write. Callers must grant attestations: write and id-token: write to their release job (already done in all Sogeor repositories). slsa-github-generator was not used: it is no longer maintained and cannot be pinned by SHA.

How it was tested

• pre-commit run --all-files; inputs and outputs checked against action.yml of the pinned actions.
• The first run is the release of this repository; verify with gh attestation verify.

Checklist

• The PR title follows Conventional Commits (feat:, fix:, feat!: for breaking changes)
• Tests and documentation are added or updated
• pre-commit run --all-files passes locally
• No secrets in plain text; any Secret / *.sops.yaml is SOPS-encrypted
• Breaking changes and migration steps are described above