From 081db287acab2cfd0aaec9020a0a6e404b4bb137 Mon Sep 17 00:00:00 2001
From: m-kk <46383441+m-kk@users.noreply.github.com>
Date: Fri, 10 Jul 2026 12:26:51 -0500
Subject: [PATCH] =?UTF-8?q?=F0=9F=91=B7=20ci:=20attest=20build=20provenanc?=
 =?UTF-8?q?e=20for=20release=20assets?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/release.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d9e0abe..239d12b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@v5
 
@@ -24,6 +26,14 @@ jobs:
           npm test
           npm run build
 
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: |
+            main.js
+            manifest.json
+            styles.css
+
       - name: Create release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}