From 10977dad115e93405b6686d405599844cf2929e4 Mon Sep 17 00:00:00 2001
From: pdriggett <pmbigham@gmail.com>
Date: Thu, 18 Jun 2026 06:21:58 -0400
Subject: [PATCH] Add release workflow with build provenance attestations

Builds the plugin in CI on tag push and publishes the GitHub release with
attested main.js, manifest.json, and styles.css, addressing the artifact
attestation recommendation from the Obsidian plugin review.
---
 .github/workflows/release.yml | 51 +++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..c59a6fe
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,51 @@
+name: Release
+
+# Builds the plugin in CI and publishes a GitHub release whenever a version
+# tag is pushed (e.g. `0.1.3`). The build artifacts get provenance attestations
+# so users can cryptographically verify they were built from this repository.
+
+on:
+  push:
+    tags:
+      - "*"
+
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            main.js
+            manifest.json
+            styles.css
+
+      - name: Create release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --title "${GITHUB_REF_NAME}" \
+            --generate-notes \
+            main.js manifest.json styles.css