ci(release): build-provenance attestations for crates + Python (P13.2) (#91)

* ci: add OpenSSF Scorecard workflow + badge (P13.1) * ci(release): attest build provenance for crates + Python artifacts (P13.2)
2026-05-31 22:13:06 +02:00
parent c8e5d8a658
commit cee174c0de
2 changed files with 39 additions and 1 deletions
@@ -541,4 +541,41 @@ jobs:

            ### Auto-generated changelog

-            See below; GitHub computes it from the commits since the previous tag.
+            See below; GitHub computes it from the commits since the previous tag.
+
+  # --------------------------------------------------------------------------
+  # Build provenance attestations (findings P13.2)
+  # --------------------------------------------------------------------------
+  attestations:
+    name: Attest build provenance
+    needs: [cargo-publish, python-wheels, python-sdist]
+    runs-on: ubuntu-latest
+    # Signed SLSA build-provenance attestations for the published crates and
+    # Python wheels/sdist. npm tarballs already carry inline Sigstore provenance
+    # from `npm publish --provenance`, so they are covered there. This job is
+    # isolated and runs *after* the publishes on the exact uploaded bytes, so a
+    # failure here can never block or corrupt a publish (same isolation that the
+    # SBOM step lacked before #79).
+    permissions:
+      id-token: write # OIDC for keyless Sigstore signing
+      attestations: write # write the attestations to this repo
+      contents: read
+    steps:
+      - name: Download crate files
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: crate-files
+          path: artifacts/crates
+      - name: Download wheels + sdist
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: wheels-*
+          path: artifacts/python
+          merge-multiple: true
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        with:
+          subject-path: |
+            artifacts/crates/*.crate
+            artifacts/python/*.whl
+            artifacts/python/*.tar.gz