fix(release): attest release assets

.github/workflows/release-auto.yml

@@ -8,6 +8,8 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
   # Note: issues/pull-requests write permissions removed - not needed for current semantic-release config
 
 jobs:
@@ -69,6 +71,13 @@ jobs:
           
           echo "✅ All build artifacts present, non-empty, and syntax is valid"
 
+      - name: Attest release assets
+        uses: actions/attest@v4
+        with:
+          subject-path: |
+            main.js
+            styles.css
+
       - name: Run semantic-release
         env:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}

.github/workflows/release.yml

@@ -14,6 +14,8 @@ on:
 permissions:
     contents: write
     packages: write
+    id-token: write
+    attestations: write
 
 jobs:
     # 버전 검증
@@ -91,6 +93,13 @@ jobs:
                   fi
                   echo "✅ All required files present"
 
+            - name: Attest release assets
+              uses: actions/attest@v4
+              with:
+                  subject-path: |
+                      main.js
+                      styles.css
+
             - name: Create release archive
               run: |
                   mkdir -p release