From a2d21ea8323c5f0a98f6e4b2eed895a893d09649 Mon Sep 17 00:00:00 2001 From: iOSonntag Date: Wed, 10 Jun 2026 03:12:40 +0200 Subject: [PATCH] fix: attest release artifacts with build provenance Obsidian's plugin scan flagged that the released main.js cannot be independently reproduced from source. Add GitHub build-provenance attestation (Sigstore-signed) so the released main.js/manifest.json/ styles.css can be cryptographically verified as genuine CI output from this commit, regardless of byte-level build reproducibility: gh attestation verify main.js --repo iOSonntag/obsidian-plugin-treefocus - add id-token:write + attestations:write permissions - attest-build-provenance pinned by commit SHA, gated to real releases Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0b66bf0..eaa9103 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -5,9 +5,11 @@ on: branches: - master -# Least-privilege token; the release steps below need to push tags & create releases. +# Least-privilege token. permissions: - contents: write + contents: write # push the release commit/tag and create the GitHub release + id-token: write # OIDC token for build-provenance attestation (Sigstore signing) + attestations: write # publish the artifact attestation jobs: build: @@ -84,6 +86,18 @@ jobs: --title="Release v$VERSION" \ main.js manifest.json styles.css + # Build provenance: cryptographically attest (via Sigstore) that these exact + # artifacts were produced by this workflow from this commit. Lets users verify + # the release with `gh attestation verify main.js --repo /`. + - name: Attest build provenance + if: steps.chkVersion.outputs.NEXT_RELEASE_VERSION != '' + uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 + with: + subject-path: | + main.js + manifest.json + styles.css + - name: Push Tag and staged Files if: steps.chkVersion.outputs.NEXT_RELEASE_VERSION != '' env: