From d3bea1d4d5e88a137686e0347fcc5ba576279a23 Mon Sep 17 00:00:00 2001
From: tslee <tslee@tsleeui-MacBookPro.local>
Date: Mon, 18 May 2026 17:03:33 +0900
Subject: [PATCH] fix(release): attest release assets

---
 .github/workflows/release-auto.yml | 9 +++++++++
 .github/workflows/release.yml      | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/.github/workflows/release-auto.yml b/.github/workflows/release-auto.yml
index a0bdf31..7389e46 100644
--- a/.github/workflows/release-auto.yml
+++ b/.github/workflows/release-auto.yml
@@ -8,6 +8,8 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
   # Note: issues/pull-requests write permissions removed - not needed for current semantic-release config
 
 jobs:
@@ -69,6 +71,13 @@ jobs:
           
           echo "✅ All build artifacts present, non-empty, and syntax is valid"
 
+      - name: Attest release assets
+        uses: actions/attest@v4
+        with:
+          subject-path: |
+            main.js
+            styles.css
+
       - name: Run semantic-release
         env:
           GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 57387be..ee4ffe9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,6 +14,8 @@ on:
 permissions:
     contents: write
     packages: write
+    id-token: write
+    attestations: write
 
 jobs:
     # 버전 검증
@@ -91,6 +93,13 @@ jobs:
                   fi
                   echo "✅ All required files present"
 
+            - name: Attest release assets
+              uses: actions/attest@v4
+              with:
+                  subject-path: |
+                      main.js
+                      styles.css
+
             - name: Create release archive
               run: |
                   mkdir -p release