From 4e622bb06b9a18c90916b34f62b8f5bd5e71b996 Mon Sep 17 00:00:00 2001 From: Ory Medina Date: Tue, 21 Jul 2026 14:11:13 -0600 Subject: [PATCH] [OPSEC] Avoid rewriting versions and verify signatures --- .github/workflows/release.yml | 11 +++++++++++ .goreleaser.yaml | 7 ++++--- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0bc0ebe..4afee70 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,6 +14,10 @@ permissions: jobs: goreleaser: runs-on: ubuntu-latest + permissions: + contents: write # GoReleaser uploads the GitHub Release + id-token: write # keyless (sigstore) signing for build provenance + attestations: write # record the provenance attestation steps: - name: Checkout uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 @@ -50,6 +54,13 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # Signs the built archives with keyless sigstore provenance, verifiable + # with `gh attestation verify --repo tollbit/cli`. + - name: Attest build provenance + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 + with: + subject-path: "dist/*.tar.gz,dist/*.zip" + npm-publish: needs: goreleaser runs-on: ubuntu-latest diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 9d51d1b..6d47815 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -35,10 +35,11 @@ archives: checksum: name_template: "tollbit_{{ .Version }}_checksums.txt" -# Allow re-running a tag release (e.g. after fixing npm publish) without 422s on existing assets. +# Published artifacts are immutable: re-running a release keeps existing assets +# rather than overwriting them (checksums included). To fix a bad release, cut a +# new version — do not mutate a published one. Mirrors the immutable tag ruleset. release: - replace_existing_artifacts: true - mode: replace + mode: keep-existing changelog: use: git