From 01d85f463b356548e6b02988fb5d33007acb5842 Mon Sep 17 00:00:00 2001 From: Robert McConnell Date: Fri, 18 Sep 2026 14:49:09 +0000 Subject: [PATCH 1/4] ci: attest release artifacts --- .github/workflows/ci-linux-artifacts.yml | 7 +++++++ .github/workflows/ci-macos-artifacts.yml | 7 +++++++ .github/workflows/ci-windows-artifacts.yml | 7 +++++++ 3 files changed, 21 insertions(+) diff --git a/.github/workflows/ci-linux-artifacts.yml b/.github/workflows/ci-linux-artifacts.yml index 8d54bb844e..614e8266ce 100644 --- a/.github/workflows/ci-linux-artifacts.yml +++ b/.github/workflows/ci-linux-artifacts.yml @@ -7,6 +7,8 @@ on: permissions: contents: write + id-token: write + attestations: write jobs: build-linux-artifacts: @@ -49,6 +51,11 @@ jobs: avifenc avifdec avifgainmaputil + - name: Attest release artifact + uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3 + with: + subject-path: build/linux-artifacts.zip + - name: Upload artifacts env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/ci-macos-artifacts.yml b/.github/workflows/ci-macos-artifacts.yml index 98ede18b6e..3358d8605f 100644 --- a/.github/workflows/ci-macos-artifacts.yml +++ b/.github/workflows/ci-macos-artifacts.yml @@ -7,6 +7,8 @@ on: permissions: contents: write + id-token: write + attestations: write jobs: build-macos-artifacts: @@ -60,6 +62,11 @@ jobs: avifdec avifgainmaputil README.txt + - name: Attest release artifact + uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3 + with: + subject-path: build/${{ runner.os }}-artifacts.zip + - name: Upload artifacts env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/ci-windows-artifacts.yml b/.github/workflows/ci-windows-artifacts.yml index 99a19bc51c..8ccc7af4de 100644 --- a/.github/workflows/ci-windows-artifacts.yml +++ b/.github/workflows/ci-windows-artifacts.yml @@ -7,6 +7,8 @@ on: permissions: contents: write + id-token: write + attestations: write jobs: build-windows-artifacts: @@ -80,6 +82,11 @@ jobs: filename: "windows-artifacts.zip" directory: "build/Release" path: "*.exe" + - name: Attest release artifact + uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3 + with: + subject-path: build/Release/windows-artifacts.zip + - name: Upload artifacts shell: pwsh env: From 84fc9f5d32cb56c304cc3292bded6c750ee2207c Mon Sep 17 00:00:00 2001 From: Robert McConnell Date: Sat, 26 Sep 2026 16:16:44 -0400 Subject: [PATCH 2/4] ci: use actions/attest for release provenance --- .github/workflows/ci-linux-artifacts.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-linux-artifacts.yml b/.github/workflows/ci-linux-artifacts.yml index 614e8266ce..6e528bfa53 100644 --- a/.github/workflows/ci-linux-artifacts.yml +++ b/.github/workflows/ci-linux-artifacts.yml @@ -52,7 +52,7 @@ jobs: avifdec avifgainmaputil - name: Attest release artifact - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: build/linux-artifacts.zip From 8b52cc888628bdacb036db1b81425e73b04ce4ce Mon Sep 17 00:00:00 2001 From: Robert McConnell Date: Sat, 26 Sep 2026 16:16:46 -0400 Subject: [PATCH 3/4] ci: use actions/attest for release provenance --- .github/workflows/ci-macos-artifacts.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-macos-artifacts.yml b/.github/workflows/ci-macos-artifacts.yml index 3358d8605f..97e62aee92 100644 --- a/.github/workflows/ci-macos-artifacts.yml +++ b/.github/workflows/ci-macos-artifacts.yml @@ -63,7 +63,7 @@ jobs: avifgainmaputil README.txt - name: Attest release artifact - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: build/${{ runner.os }}-artifacts.zip From d4241c9e91f6700dc4de56cd29f8afda66e01528 Mon Sep 17 00:00:00 2001 From: Robert McConnell Date: Sat, 26 Sep 2026 16:16:48 -0400 Subject: [PATCH 4/4] ci: use actions/attest for release provenance --- .github/workflows/ci-windows-artifacts.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-windows-artifacts.yml b/.github/workflows/ci-windows-artifacts.yml index 8ccc7af4de..60028faba6 100644 --- a/.github/workflows/ci-windows-artifacts.yml +++ b/.github/workflows/ci-windows-artifacts.yml @@ -83,7 +83,7 @@ jobs: directory: "build/Release" path: "*.exe" - name: Attest release artifact - uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-path: build/Release/windows-artifacts.zip