ci(release): generate build provenance attestations for artifacts

2026-08-25 07:30:12 +07:00
parent ced1913c98
commit d7bbaddb12
1 changed files with 18 additions and 0 deletions
@@ -23,6 +23,10 @@ jobs:

  build-macos:
    runs-on: macos-latest
+    permissions:
+      contents: read
+      id-token: write      # Required for build provenance attestation (OIDC)
+      attestations: write  # Required to publish the attestation
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

@@ -60,8 +64,17 @@ jobs:
          name: macos-binary
          path: dist/mcp-mt5-quant-macos-arm64.tar.gz

+      - name: Generate build provenance attestation
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/mcp-mt5-quant-macos-arm64.tar.gz
+
  build-linux:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write      # Required for build provenance attestation (OIDC)
+      attestations: write  # Required to publish the attestation
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

@@ -99,6 +112,11 @@ jobs:
          name: linux-binary
          path: dist/mcp-mt5-quant-linux-x64.tar.gz

+      - name: Generate build provenance attestation
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/mcp-mt5-quant-linux-x64.tar.gz
+
  # ── Cargo Publish ────────────────────────────────────────────────────────────

  cargo-publish: