From 58080bd5c2064de1322d7a78514204b761bd01ca Mon Sep 17 00:00:00 2001 From: Denis_Drobyshev Date: Fri, 18 Sep 2026 23:18:02 +0300 Subject: [PATCH] Sign what a release ships The release already carries the distributions. What it did not carry was anything tying them to the run that produced them, so "this wheel came from that commit" was a claim with nothing behind it. The attestation is produced in the build job rather than in the job that creates the release: a later job holding the same artefact can only attest that it downloaded it, which is not the claim anyone wants to verify. PyPI-side PEP 740 attestations are unchanged; gh-action-pypi-publish produces those by default under Trusted Publishing. --- .github/workflows/release.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 385f009..3f6b237 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -61,6 +61,12 @@ jobs: name: Build distributions needs: verify runs-on: ubuntu-latest + permissions: + # The attestation has to be produced by the job that did the building. A + # later job holding the same artefact can only attest that it downloaded + # it, which is not the claim anyone wants to verify. + id-token: write + attestations: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7 @@ -118,6 +124,20 @@ jobs: /tmp/fresh/bin/mlango startplugin mlango-smoke --kind trainer test -f mlango-smoke/pyproject.toml + # The release already carries the distributions; what it did not carry was + # anything tying them to the run that produced them. attest-build-provenance + # signs a SLSA statement naming this repository, this workflow and this + # commit as the builder: + # + # gh attestation verify --repo DrobyshevDev/mlango + # + # PyPI-side PEP 740 attestations are unchanged; gh-action-pypi-publish + # produces those by default under Trusted Publishing. + - name: Attest the build provenance + uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4 + with: + subject-path: "dist/*" + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: dist