From e163ada535ab2c2286e566757e34bfe881f010bf Mon Sep 17 00:00:00 2001 From: Nathan Agrin Date: Tue, 12 May 2026 10:07:40 -0700 Subject: [PATCH 1/2] ci: attest release artifacts with GitHub Artifact Attestations Sign release archives and checksums.txt via Sigstore-backed GitHub Artifact Attestations during the release workflow. Users can then verify provenance with: gh attestation verify omni_X.Y.Z__.tar.gz --repo exploreomni/cli Adds id-token: write and attestations: write to the release job's permissions block (required for OIDC + attestation upload). The minted OIDC token only authorizes signing attestations under this repo's identity; it cannot publish or replace artifacts. Pinned actions/attest-build-provenance to a commit SHA per the same hardening rationale applied to other workflow actions. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/release.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1692f1b..90214fd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,6 +7,8 @@ on: permissions: contents: write + id-token: write + attestations: write jobs: release: @@ -28,6 +30,14 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Attest release artifacts + uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 + with: + subject-path: | + dist/omni_*.tar.gz + dist/omni_*.zip + dist/checksums.txt + - name: Checkout Homebrew tap if: ${{ !contains(github.ref_name, '-') }} uses: actions/checkout@v4 From 6440fb7517a9d650957dd7dce2ff941e896bfddf Mon Sep 17 00:00:00 2001 From: Nathan Agrin Date: Tue, 12 May 2026 10:07:41 -0700 Subject: [PATCH 2/2] docs: document release verification with gh attestation verify Co-Authored-By: Claude Opus 4.7 (1M context) --- README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/README.md b/README.md index 44a6a64..8de96a8 100644 --- a/README.md +++ b/README.md @@ -28,6 +28,16 @@ Pre-built binaries for macOS, Linux, and Windows are available on the [Releases | Linux | amd64, arm64 | | Windows | amd64 | +### Verifying release artifacts + +Release archives and `checksums.txt` are signed with [GitHub Artifact Attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds) (Sigstore under the hood). The install script and Homebrew formula already verify SHA-256 checksums; attestations let you additionally prove the artifact was built by this repo's `release.yml` workflow. + +Verify a downloaded archive with the GitHub CLI: + +```bash +gh attestation verify omni_1.2.3_linux_amd64.tar.gz --repo exploreomni/cli +``` + ### Build from source ```bash