ci(release): stop uploading the attestation bundle to immutable releases

.github/workflows/release.yaml

@@ -50,21 +50,10 @@ jobs:
       # (source tarball and SBOM), signed keyless via Sigstore and stored in
       # GitHub's attestation API. Verify with:
       #   gh attestation verify <artifact> -R adrianbrad/queue
+      # The bundle is not attached to the release: this repository uses
+      # immutable releases, which reject asset uploads once goreleaser has
+      # published. Fetch it with `gh attestation download` instead.
       - name: Attest build provenance
-        id: attest
         uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-checksums: dist/checksums.txt
-
-      # Attach the Sigstore bundle to the release so the provenance can be
-      # verified offline (gh attestation verify --bundle) without API access.
-      - name: Upload provenance bundle to the release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          BUNDLE: ${{ steps.attest.outputs.bundle-path }}
-          TAG: ${{ github.ref_name }}
-        run: |
-          set -euo pipefail
-          name="queue-${TAG#v}.sigstore.json"
-          cp "$BUNDLE" "dist/$name"
-          gh release upload "$TAG" "dist/$name" --clobber

.goreleaser.yaml

@@ -65,13 +65,14 @@ release:
     gh attestation verify {{ .ProjectName }}-{{ .Version }}-source.tar.gz -R adrianbrad/queue
     ```
 
-    Or against the bundle attached to this release, without querying the
-    attestations API:
+    To verify offline later, download the attestation bundle once and verify
+    against it:
 
     ```bash
+    gh attestation download {{ .ProjectName }}-{{ .Version }}-source.tar.gz -R adrianbrad/queue
     gh attestation verify {{ .ProjectName }}-{{ .Version }}-source.tar.gz \
       -R adrianbrad/queue \
-      --bundle {{ .ProjectName }}-{{ .Version }}.sigstore.json
+      --bundle sha256:*.jsonl
     ```
 
 changelog: