Logan Yang 3b8af4d341 ci(release): publish artifact attestations for release assets (#2431) ... Add a step that signs main.js, manifest.json, and styles.css with the workflow's OIDC identity and publishes the attestation to Sigstore's public transparency log via actions/attest-build-provenance@v2. Why: Obsidian's plugin review tooling flags release assets without an attestation as a soft warning. Attestations cryptographically prove the asset was built by this workflow on this commit, defending against an attacker who gains release-asset-replace permissions and silently swaps in a compromised main.js. Verification post-release: gh attestation verify main.js --owner logancyang --repo logancyang/obsidian-copilot Placement: the new step runs AFTER the prerelease manifest swap and BEFORE gh release create. That way the attested manifest.json is exactly the bytes that get uploaded — for stable releases that's the committed manifest.json; for prereleases it's the in-runner copy of manifest-beta.json. Permissions: adds attestations: write and id-token: write to the job. The id-token: write permission is what allows the workflow to request an OIDC token from GitHub; the attest action uses that token as proof of identity when signing. No secrets to manage. Free for public repos. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>		2026-05-13 17:09:14 -07:00
..
node.js.yml	Implement autonomous agent (#1689)	2025-08-04 09:51:18 -07:00
release.yml	ci(release): publish artifact attestations for release assets (#2431)	2026-05-13 17:09:14 -07:00