From f7f947e0486b78d976e4ae7b704980823b74ec3c Mon Sep 17 00:00:00 2001 From: kingchenc Date: Mon, 1 Jun 2026 01:08:14 +0200 Subject: [PATCH] docs(changelog): record provenance attestations + CI security tooling (Unreleased) (#102) --- CHANGELOG.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2d74fe0b..070a7e0d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Added +- **Build-provenance attestations for release artifacts.** The release workflow + now emits signed SLSA build-provenance attestations for the published crates + and Python wheels/sdist (`actions/attest-build-provenance`); npm packages + carry inline Sigstore provenance from `npm publish --provenance`. Every + published artifact is cryptographically traceable to this repository's release + workflow run. + +### Security +- **CodeQL static analysis and OpenSSF Scorecard run in CI.** CodeQL (Rust, + Python, JavaScript) and the OpenSSF Scorecard workflow now run on every push; + results appear under Security → Code scanning and a public Scorecard badge is + shown in the README. +- **CI workflows hardened against script injection.** Untrusted event contexts + (PR branch names, `workflow_dispatch` inputs) are passed through the step + environment instead of being interpolated directly into shell commands. + ### Changed - **Node binding: invalid indicator periods now throw instead of being silently clamped.** The scalar-indicator constructors previously clamped `period = 0`