ci(release): build-provenance attestations for crates + Python (P13.2) (#91)

* ci: add OpenSSF Scorecard workflow + badge (P13.1)

* ci(release): attest build provenance for crates + Python artifacts (P13.2)

.github/workflows/release.yml

@@ -542,3 +542,40 @@ jobs:
             ### Auto-generated changelog
 
             See below; GitHub computes it from the commits since the previous tag.
+
+  # --------------------------------------------------------------------------
+  # Build provenance attestations (findings P13.2)
+  # --------------------------------------------------------------------------
+  attestations:
+    name: Attest build provenance
+    needs: [cargo-publish, python-wheels, python-sdist]
+    runs-on: ubuntu-latest
+    # Signed SLSA build-provenance attestations for the published crates and
+    # Python wheels/sdist. npm tarballs already carry inline Sigstore provenance
+    # from `npm publish --provenance`, so they are covered there. This job is
+    # isolated and runs *after* the publishes on the exact uploaded bytes, so a
+    # failure here can never block or corrupt a publish (same isolation that the
+    # SBOM step lacked before #79).
+    permissions:
+      id-token: write # OIDC for keyless Sigstore signing
+      attestations: write # write the attestations to this repo
+      contents: read
+    steps:
+      - name: Download crate files
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: crate-files
+          path: artifacts/crates
+      - name: Download wheels + sdist
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: wheels-*
+          path: artifacts/python
+          merge-multiple: true
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        with:
+          subject-path: |
+            artifacts/crates/*.crate
+            artifacts/python/*.whl
+            artifacts/python/*.tar.gz

README.md

@@ -7,6 +7,7 @@
 [![npm](https://img.shields.io/npm/v/wickra.svg?logo=npm&color=red)](https://www.npmjs.com/package/wickra)
 [![License: PolyForm-NC](https://img.shields.io/badge/license-PolyForm--NC--1.0.0-purple)](LICENSE)
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/wickra-lib/wickra/badge)](https://scorecard.dev/viewer/?uri=github.com/wickra-lib/wickra)
+[![Build provenance](https://img.shields.io/badge/provenance-attested-brightgreen?logo=github)](https://github.com/wickra-lib/wickra/attestations)
 
 **Streaming-first technical indicators. Install with `pip install wickra` — no system dependencies.**