mirror of
https://github.com/logancyang/obsidian-copilot.git
synced 2026-07-22 07:50:24 +00:00
3b8af4d341
Add a step that signs main.js, manifest.json, and styles.css with the workflow's OIDC identity and publishes the attestation to Sigstore's public transparency log via actions/attest-build-provenance@v2. Why: Obsidian's plugin review tooling flags release assets without an attestation as a soft warning. Attestations cryptographically prove the asset was built by this workflow on this commit, defending against an attacker who gains release-asset-replace permissions and silently swaps in a compromised main.js. Verification post-release: gh attestation verify main.js --owner logancyang --repo logancyang/obsidian-copilot Placement: the new step runs AFTER the prerelease manifest swap and BEFORE gh release create. That way the attested manifest.json is exactly the bytes that get uploaded — for stable releases that's the committed manifest.json; for prereleases it's the in-runner copy of manifest-beta.json. Permissions: adds attestations: write and id-token: write to the job. The id-token: write permission is what allows the workflow to request an OIDC token from GitHub; the attest action uses that token as proof of identity when signing. No secrets to manage. Free for public repos. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| ISSUE_TEMPLATE | ||
| workflows | ||
| FUNDING.yml | ||