Repository navigation
ci: publish the attestation bundle with each release #87
Description
A release has two tarballs and SHA256SUMS today. The build provenance attestation is only in GitHub's attestation store. Without --bundle, gh attestation verify needs a GitHub login, even for a public repository (cli/cli#11803, seen 2026-10-17). A broker host should have no GitHub login. With the bundle as a file, gh attestation verify --bundle needs no login. It still gets the Sigstore trusted root online.
The installer and nodkey update need this file (issue to follow).
actions/attest has a bundle-path output. It is one Sigstore bundle for all subjects of the step, so one file covers both tarballs (actions/attest outputs).
Done when
- The attest step in the
publishjob has anid. The job saves itsbundle-pathfile asnodkey_<version>.sigstore.jsonand uploads it with the tarballs, before the release is published. After that, an immutable release takes no more files. -
publishgets no new permission and still runs no code from the repository. Values fromneeds.*.outputsreach the shell only throughenv:, never as${{ }}insiderun:. - docs/releasing.md lists the new file. Its "Verify a download" section shows the check with
--bundle, which needs no login, next to the check without it. - docs/releasing.md says that 0.1.0 has no bundle file.
- The first release after this has the file, and
gh attestation verify --bundlepasses with it on a machine with no GitHub login. Tick this after that release.
Activity
groupsky commentedon Oct 16, 2026
The installer and
nodkey updateare #88.groupsky commentedon Oct 16, 2026
Done in #91 (f6e47bb), except the last box. It waits for the next release: check that the release has
nodkey_<version>.sigstore.jsonand thatgh attestation verify --bundlepasses with it on a machine with no GitHub login. The publish job now also runs that check before it publishes.groupsky commentedon Oct 17, 2026
Checked on 2026-10-17 with the 0.2.0 release (published 06:18:45 UTC, immutable). It has
nodkey_0.2.0.sigstore.json. On a machine with no GitHub login (emptyGH_CONFIG_DIR, no token), gh 2.96.0 ran the three steps of docs/releasing.md:sha256sum -cprinted OK,gh attestation verify --bundleexited 0, and the name check printednodkey_0.2.0_linux_amd64.tar.gz../nodkey version --offlineprintednodkey 0.2.0. The publish job had run the same check before it published.