33910883519
80%

Ran 04 Sep 2026 07:32PM UTC

Jobs 1

Files 89

Run time 1min

Badge

Embed ▾

Committed 04 Sep 2026 07:23PM UTC coverage: 80.119% (-0.1%) from 80.264%

Build # 33910883519

Build Type

push

github

Committed by

web-flow

Commit Message

ci: attach SLSA provenance to release assets (#781)

## What
Adds a `*.intoto.jsonl` SLSA provenance asset to each release.
Closes #673 

## Why
Release artefacts are cosign-signed keyless with a `*.sigstore.json`
bundle
per file, which earns 8/10 on OpenSSF Scorecard's Signed-Releases check.
The
remaining 2 points need a provenance file **present in the release's
assets**.
We already run `actions/attest`, but it stores the attestation in
GitHub's
attestation store, which Scorecard never inspects — so the check is
capped
at 8/10.

## Testing
Workflow logic exercised locally with `act`:

- the provenance file stays out of `checksums.txt`
- cosign skip it
- it appears exactly once in the upload set

Not locally testable: `actions/attest` itself needs GitHub OIDC.

For remote testing on a release with attached attestation:
gh attestation verify <binary> --bundle <prefix>-<tag>.intoto.jsonl




<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Release downloads now include provenance attestation files alongside
binaries, checksums, and signatures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Coverage Stats

5513 of 6881 relevant lines covered (80.12%)

30.3 hits per line

Coverage Regressions

Lines	Coverage	∆	File
12	77.9	-1.09%	pkg/controller/target_controller.go
2	74.28	-0.64%	pkg/controller/helpers.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	33910883519.1	04 Sep 2026 07:31PM UTC	89	80.12	GitHub Action Run

opendefensecloud / solution-arsenal / 33910883519
80%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 33910883519

opendefensecloud / solution-arsenal / 33910883519 80%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 33910883519

opendefensecloud / solution-arsenal / 33910883519
80%

README BADGES
x