From f2fd8e44e0f145149d910ed9d1fd6c42de64439e Mon Sep 17 00:00:00 2001
From: RavenHogwarts <fengyj120@163.com>
Date: Wed, 13 May 2026 15:09:19 +0800
Subject: [PATCH] =?UTF-8?q?ci:=20=E6=B7=BB=E5=8A=A0=E6=9E=84=E5=BB=BA?=
 =?UTF-8?q?=E5=88=B6=E5=93=81=E8=AF=81=E6=98=8E=E7=94=9F=E6=88=90=E5=8A=9F?=
 =?UTF-8?q?=E8=83=BD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

在发布工作流中添加构建制品证明生成步骤，以增强
安全性和可追溯性。

新增 id-token 和 attestations 权限以支持制品
证明的生成。使用 actions/attest-build-provenance
操作为主要输出文件（main.js、manifest.json 和
styles.css）生成证明，确保发布的制品的完整性
和来源可验证。
---
 .github/workflows/release.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 979543b..c531185 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,8 @@ on:
 
 permissions:
     contents: write
+    id-token: write
+    attestations: write
 
 env:
     PLUGIN_ID: ace-code-editor # 插件ID
@@ -61,6 +63,14 @@ jobs:
                   pnpm run build
                   echo "tag_name=$(git tag --sort version:refname | tail -n 1)" >> $GITHUB_OUTPUT
 
+            - name: Generate artifact attestation
+              uses: actions/attest-build-provenance@v2
+              with:
+                  subject-path: |
+                      dist/main.js
+                      dist/manifest.json
+                      dist/styles.css
+
             - name: Create Release
               id: create_release
               uses: softprops/action-gh-release@v2