Merge pull request #48 from GrantBirki/add-release-attestations

Add release bundle attestations

Author: GrantBirki

.github/workflows/release.yml

@@ -8,7 +8,10 @@ on:
       - src/version.ts
 
 permissions:
+  attestations: write
+  artifact-metadata: write
   contents: write
+  id-token: write
 
 concurrency:
   group: release
@@ -101,6 +104,13 @@ jobs:
             exit 1
           fi
 
+      - name: attest release bundle
+        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # pin@v4.1.1
+        with:
+          subject-path: |
+            action.yml
+            dist/**
+
       - name: create release tag
         id: release-tag
         env:

AGENTS.md

@@ -251,7 +251,8 @@ The CI workflows are intentionally separated:
   reactions fail.
 - `.github/workflows/release.yml` runs on pushes to `main` that change
   `src/version.ts`. It validates the committed bundle, creates the immutable
-  release tag, creates a GitHub release, and moves the matching major tag.
+  release tag, creates provenance attestations, creates a GitHub release, and
+  moves the matching major tag.
 
 When changing workflows, follow the pattern used here and in
 `/Users/birki/code/branch-deploy`: clear job names, explicit permissions,
@@ -269,8 +270,9 @@ High-level release flow:
    same pull request.
 3. Merge the pull request to protected `main`.
 4. Let `.github/workflows/release.yml` validate the bundle, create the
-   immutable release tag, create the GitHub release with generated notes, and
-   move the matching major tag such as `v3`.
+   immutable release tag, create provenance attestations for `action.yml` and
+   `dist/**`, create the GitHub release with generated notes, and move the
+   matching major tag such as `v3`.
 
 `src/version.ts` is the only release version source. `package.json` intentionally
 keeps `0.0.0` because this repository is released as a GitHub Action, not an npm

dist/index.js

@@ -1 +1 @@
-export const VERSION = 'v3.0.2' as const
+export const VERSION = 'v3.0.3' as const