ci(release): attest build provenance and attach the bundle to releases

.github/workflows/release.yaml

@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: write # create GitHub Releases
       id-token: write # cosign keyless signing via Sigstore OIDC
-      attestations: write # build provenance
+      attestations: write # persist SLSA build provenance attestations
 
     steps:
       - name: Checkout code
@@ -45,3 +45,26 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      # SLSA v1 build provenance for every artifact listed in checksums.txt
+      # (source tarball and SBOM), signed keyless via Sigstore and stored in
+      # GitHub's attestation API. Verify with:
+      #   gh attestation verify <artifact> -R adrianbrad/queue
+      - name: Attest build provenance
+        id: attest
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-checksums: dist/checksums.txt
+
+      # Attach the Sigstore bundle to the release so the provenance can be
+      # verified offline (gh attestation verify --bundle) without API access.
+      - name: Upload provenance bundle to the release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          BUNDLE: ${{ steps.attest.outputs.bundle-path }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          name="queue-${TAG#v}.sigstore.json"
+          cp "$BUNDLE" "dist/$name"
+          gh release upload "$TAG" "dist/$name" --clobber

.goreleaser.yaml

@@ -57,6 +57,23 @@ release:
       checksums.txt
     ```
 
+    The source tarball and SBOM also carry SLSA v1 build provenance as a GitHub
+    artifact attestation. Verify that an artifact was built by this repository's
+    release workflow:
+
+    ```bash
+    gh attestation verify {{ .ProjectName }}-{{ .Version }}-source.tar.gz -R adrianbrad/queue
+    ```
+
+    Or against the bundle attached to this release, without querying the
+    attestations API:
+
+    ```bash
+    gh attestation verify {{ .ProjectName }}-{{ .Version }}-source.tar.gz \
+      -R adrianbrad/queue \
+      --bundle {{ .ProjectName }}-{{ .Version }}.sigstore.json
+    ```
+
 changelog:
   use: github
   sort: asc