From 6c4ef36239efee526636246a43824fde724a86ac Mon Sep 17 00:00:00 2001 From: "isaprettycoolguy@protonmail.com" <6576516+nyxsys@users.noreply.github.com> Date: Fri, 15 May 2026 14:31:39 -0400 Subject: [PATCH] add artifact attestation for main.js and styles.css Attests build provenance via actions/attest-build-provenance@v2 for both release assets, addressing the Obsidian portal security recommendation. Requires id-token:write and attestations:write permissions (added). Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/release.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 71b790b..92b9c9c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -10,6 +10,8 @@ jobs: runs-on: ubuntu-latest permissions: contents: write + id-token: write + attestations: write steps: - uses: actions/checkout@v4 with: @@ -54,6 +56,14 @@ jobs: if: steps.check.outputs.exists == 'false' run: npm run build + - name: Attest build provenance + if: steps.check.outputs.exists == 'false' + uses: actions/attest-build-provenance@v2 + with: + subject-path: | + main.js + styles.css + - name: Tag and create release if: steps.check.outputs.exists == 'false' env: