From cee174c0de247562a3312f5b9b2561b65cce9499 Mon Sep 17 00:00:00 2001 From: kingchenc Date: Sun, 31 May 2026 22:13:06 +0200 Subject: [PATCH] ci(release): build-provenance attestations for crates + Python (P13.2) (#91) * ci: add OpenSSF Scorecard workflow + badge (P13.1) * ci(release): attest build provenance for crates + Python artifacts (P13.2) --- .github/workflows/release.yml | 39 ++++++++++++++++++++++++++++++++++- README.md | 1 + 2 files changed, 39 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4694f19d..185397c3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -541,4 +541,41 @@ jobs: ### Auto-generated changelog - See below; GitHub computes it from the commits since the previous tag. \ No newline at end of file + See below; GitHub computes it from the commits since the previous tag. + + # -------------------------------------------------------------------------- + # Build provenance attestations (findings P13.2) + # -------------------------------------------------------------------------- + attestations: + name: Attest build provenance + needs: [cargo-publish, python-wheels, python-sdist] + runs-on: ubuntu-latest + # Signed SLSA build-provenance attestations for the published crates and + # Python wheels/sdist. npm tarballs already carry inline Sigstore provenance + # from `npm publish --provenance`, so they are covered there. This job is + # isolated and runs *after* the publishes on the exact uploaded bytes, so a + # failure here can never block or corrupt a publish (same isolation that the + # SBOM step lacked before #79). + permissions: + id-token: write # OIDC for keyless Sigstore signing + attestations: write # write the attestations to this repo + contents: read + steps: + - name: Download crate files + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: crate-files + path: artifacts/crates + - name: Download wheels + sdist + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + pattern: wheels-* + path: artifacts/python + merge-multiple: true + - name: Attest build provenance + uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 + with: + subject-path: | + artifacts/crates/*.crate + artifacts/python/*.whl + artifacts/python/*.tar.gz \ No newline at end of file diff --git a/README.md b/README.md index 18aea2b6..db590ac5 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,7 @@ [![npm](https://img.shields.io/npm/v/wickra.svg?logo=npm&color=red)](https://www.npmjs.com/package/wickra) [![License: PolyForm-NC](https://img.shields.io/badge/license-PolyForm--NC--1.0.0-purple)](LICENSE) [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/wickra-lib/wickra/badge)](https://scorecard.dev/viewer/?uri=github.com/wickra-lib/wickra) +[![Build provenance](https://img.shields.io/badge/provenance-attested-brightgreen?logo=github)](https://github.com/wickra-lib/wickra/attestations) **Streaming-first technical indicators. Install with `pip install wickra` — no system dependencies.**