Skip to content

ci: attest release binaries#2352

Open
dyoshikawa wants to merge 3 commits into
mainfrom
issue-2346-artifact-attestations
Open

ci: attest release binaries#2352
dyoshikawa wants to merge 3 commits into
mainfrom
issue-2346-artifact-attestations

Conversation

@dyoshikawa

Copy link
Copy Markdown
Owner

Summary:

  • publish GitHub Artifact Attestations for every release binary from SHA256SUMS
  • grant the release workflow the minimal attestation and OIDC permissions
  • document provenance verification with GitHub CLI

Test plan:

  • pnpm cicheck

Closes #2346

@dyoshikawa dyoshikawa closed this Jul 23, 2026
@dyoshikawa dyoshikawa reopened this Jul 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

rulesync releases have no GitHub Artifact Attestation, causing false supply-chain warnings in mise

2 participants