5 commits

Author	SHA1	Message	Date
Gary Ritchie	9e2e0cc30d	Attest release artifacts with build provenance (#52) ... Add actions/attest-build-provenance step to the release workflow so main.js and styles.css are signed via Sigstore and verifiable with `gh attestation verify`. Grants the job id-token: write and attestations: write to support OIDC token minting and recording.	2026-05-12 18:15:55 -06:00
Gary Ritchie	d44b9a1899	add FUNDING.yml	2026-03-29 08:30:13 -06:00
Gary Ritchie	93e0db0756	Fix lint permissions and validate release tags ... Grant contents: read to the lint job so checkout works with the restrictive top-level permissions: {} block. Restrict release trigger to semver tags and validate the pushed tag matches manifest.json version before building.	2026-03-28 15:15:32 -06:00
Gary Ritchie	f8437f1c55	Add release workflow and harden CI ... Add GitHub Actions workflow that creates a draft release with plugin artifacts (main.js, manifest.json, styles.css) when a tag is pushed. Also pin actions to SHA hashes, add persist-credentials: false, and set explicit permissions in the lint workflow.	2026-03-28 15:12:55 -06:00
Gary Ritchie	ea6de67a85	Initial commit	2026-03-24 19:27:30 -06:00