From 23e51a867fd2bd9fc5952657c4c6bebfd8b78323 Mon Sep 17 00:00:00 2001
From: Nossimonov <277402702+Nossimonov@users.noreply.github.com>
Date: Tue, 21 Jul 2026 16:23:30 -0700
Subject: [PATCH] Store review round: plain MIT, source synced per release,
 asset attestations

The automated review requires source in the repository (closed-source
unsupported), a recognized license (the CC-BY exception paragraph broke
detection and referenced a directory this repo does not have), and
recommends provenance attestations. The release workflow now syncs src/
and styles.css from the monorepo on every release and attests the
release assets; LICENSE is vanilla MIT.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 23 ++++++++++++++++++-----
 LICENSE                       |  9 +--------
 README.md                     |  2 +-
 3 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2f4d173..6e88d55 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,7 +1,9 @@
 # Builds the plugin from the Chartdown monorepo (the single source of truth)
 # and cuts a release the Obsidian community store can consume: tag = exact
 # manifest version (no v prefix), with main.js / manifest.json / styles.css
-# as individual assets, and the root manifest.json + versions.json synced.
+# as individual assets carrying build-provenance attestations, and the root
+# manifest.json + versions.json + src/ synced (the store requires source in
+# the repository).
 name: Release plugin
 
 on:
@@ -13,6 +15,8 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 jobs:
   release:
@@ -35,8 +39,12 @@ jobs:
         working-directory: chartdown
       - id: version
         run: echo "version=$(node -p "require('./chartdown/packages/obsidian/manifest.json').version")" >> "$GITHUB_OUTPUT"
-      - name: Sync root manifest.json and versions.json
+      - name: Sync source, manifest.json, and versions.json from the monorepo
         run: |
+          rm -rf src
+          cp -r chartdown/packages/obsidian/src src
+          cp chartdown/packages/obsidian/styles.css styles.css
+          cp chartdown/packages/obsidian/tsconfig.json tsconfig.json
           cp chartdown/packages/obsidian/dist/manifest.json manifest.json
           node -e "
             const fs = require('fs');
@@ -47,9 +55,16 @@ jobs:
           "
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add manifest.json versions.json
+          git add -A
           git diff --cached --quiet || git commit -m "Release ${{ steps.version.outputs.version }}"
           git push
+      - name: Attest build provenance for the release assets
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            chartdown/packages/obsidian/dist/main.js
+            chartdown/packages/obsidian/dist/styles.css
+            chartdown/packages/obsidian/dist/manifest.json
       - name: Create the release (tag = exact version, per Obsidian guidelines)
         env:
           GH_TOKEN: ${{ github.token }}
@@ -61,5 +76,3 @@ jobs:
             chartdown/packages/obsidian/dist/styles.css \
             --title "$V" \
             --notes "Chartdown plugin $V — built from Nossimonov/Chartdown@${{ inputs.ref }}. See the [Chartdown changelog](https://github.com/Nossimonov/Chartdown/blob/main/CHANGELOG.md)."
-
-# (workflow indexing nudge)
diff --git a/LICENSE b/LICENSE
index 67c50b2..7dd1823 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 The Chartdown Authors
+Copyright (c) 2026 Nossimonov
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -19,10 +19,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-
----
-
-Exception: the contents of the docs/spec/ directory (the Chartdown language
-specification) are licensed under the Creative Commons Attribution 4.0
-International License (CC-BY-4.0) rather than the MIT License. See
-docs/spec/README.md.
diff --git a/README.md b/README.md
index 3b751da..a4b3775 100644
--- a/README.md
+++ b/README.md
@@ -35,7 +35,7 @@ Until the plugin is in the community store: download `main.js`, `manifest.json`,
 
 ## Development
 
-This is the **release repository**: releases are built by CI from the [Chartdown monorepo](https://github.com/Nossimonov/Chartdown) (`packages/obsidian`), which is where the source, tests, and issue tracker live. Please file issues and PRs there.
+Development happens in the [Chartdown monorepo](https://github.com/Nossimonov/Chartdown) (`packages/obsidian`), which is where the tests and issue tracker live — please file issues and PRs there. This repository carries the store-facing artifact: [`src/`](src/) and `styles.css` are synced verbatim from the monorepo by the release workflow (every release commit pins the exact source it was built from), and release assets carry [build-provenance attestations](https://github.com/Nossimonov/obsidian-chartdown/attestations). The plugin imports [`@chartdown/core`](https://www.npmjs.com/package/@chartdown/core) and [`@chartdown/render-svg`](https://www.npmjs.com/package/@chartdown/render-svg), published from the same monorepo.
 
 ## License