Merge pull request #15 from swartzrock/codex/attest-release-assets

fix: publish attested Obsidian release assets

.github/workflows/publish.yml

@@ -22,7 +22,9 @@ on:
         type: string
 
 permissions:
+  attestations: write
   contents: write
+  id-token: write
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
@@ -90,7 +92,6 @@ jobs:
 
           echo "version=${VERSION}" >> "${GITHUB_OUTPUT}"
           echo "tag_name=${TAG_NAME}" >> "${GITHUB_OUTPUT}"
-          echo "zip_name=settings-float-${VERSION}.zip" >> "${GITHUB_OUTPUT}"
 
           if gh release view "${TAG_NAME}" >/dev/null 2>&1; then
             echo "release_exists=true" >> "${GITHUB_OUTPUT}"
@@ -98,10 +99,13 @@ jobs:
             echo "release_exists=false" >> "${GITHUB_OUTPUT}"
           fi
 
-      - name: Package release zip
+      - name: Attest release assets
         if: steps.release.outputs.release_exists != 'true'
-        run: |
-          zip "${{ steps.release.outputs.zip_name }}" manifest.json main.js styles.css
+        uses: actions/attest@v4.2.0
+        with:
+          subject-path: |
+            main.js
+            styles.css
 
       - name: Create GitHub release
         if: steps.release.outputs.release_exists != 'true'
@@ -118,7 +122,6 @@ jobs:
           fi
 
           gh release create "${{ steps.release.outputs.tag_name }}" \
-            "${{ steps.release.outputs.zip_name }}" \
             manifest.json \
             main.js \
             styles.css \

.github/workflows/release.yml

@@ -47,5 +47,9 @@ jobs:
     name: Publish release
     needs: changesets
     if: needs.changesets.outputs.has-changesets == 'false'
+    permissions:
+      attestations: write
+      contents: write
+      id-token: write
     uses: ./.github/workflows/publish.yml
     secrets: inherit