From d98587a2afe27a42721ead6757ff4be46afe7d76 Mon Sep 17 00:00:00 2001 From: formax68 Date: Wed, 13 May 2026 13:54:43 +0300 Subject: [PATCH] ci(release): attest release artifacts via build-provenance (DIR-12) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Expand permissions block: add id-token: write, attestations: write, artifact-metadata: write alongside the existing contents: write - Insert "Attest release artifacts" step (actions/attest-build-provenance@v3) between "Build plugin" and "Create release"; subject-path covers all three release assets (main.js, manifest.json, styles.css) via newline-list syntax - Step ordering is load-bearing: attestation runs after build (artifacts on disk) and before gh release create (sidesteps immutable-releases timing edge) Pinned @v3 (not @v2 as originally anticipated): v2 last updated June 2025, one major behind; v3 (v3.2.0, Jan 2026) is current stable with identical input contract. See 05-RESEARCH.md §6.1 for full deviation rationale. actions/checkout@v3, actions/setup-node@v3, node-version 18.x, and --draft are all preserved unchanged (purist path — DIR-12 diff kept narrow). --- .github/workflows/release.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fbb21c4..9690de3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,6 +10,9 @@ jobs: runs-on: ubuntu-latest permissions: contents: write + id-token: write # required by attest-build-provenance to mint OIDC token + attestations: write # required by attest-build-provenance to persist attestation + artifact-metadata: write # required by v3+ for artifact metadata storage records steps: - uses: actions/checkout@v3 @@ -23,6 +26,14 @@ jobs: npm install npm run build + - name: Attest release artifacts + uses: actions/attest-build-provenance@v3 + with: + subject-path: | + main.js + manifest.json + styles.css + - name: Create release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}