Skip to content

ci(deploy): provenance #387

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KSXGitHub merged 8 commits into from
Apr 8, 2026
Merged

ci(deploy): provenance #387

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
a0f4e3f
ci(deploy): attest build provenance for release binaries
claude Apr 7, 2026
3c7fc88
docs(readme): document build provenance attestations for release bina…
claude Apr 7, 2026
c0c2344
docs(readme): improve
KSXGitHub Apr 7, 2026
180b1b9
docs(readme): improve the question
KSXGitHub Apr 7, 2026
27ac8ac
ci(deploy): attest shell completions, man page, and checksums
claude Apr 7, 2026
c9a93de
docs(readme): change styles
KSXGitHub Apr 8, 2026
93d84cc
ci(deploy): document why id-token: write is kept at job level
claude Apr 8, 2026
694c906
ci(deploy): shorten id-token: write comment
claude Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions .github/workflows/deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,11 @@ jobs:

runs-on: ubuntu-latest

permissions:
contents: read
id-token: write
attestations: write

Comment thread
KSXGitHub marked this conversation as resolved.
strategy:
fail-fast: true
matrix:
Expand All @@ -90,6 +95,11 @@ jobs:
- name: Strip all debug symbols
run: strip --strip-all target/${{ matrix.target }}/release/pdu

- name: Attest build provenance
uses: actions/attest-build-provenance@v2
with:
subject-path: target/${{ matrix.target }}/release/pdu

- name: Upload build artifact
uses: actions/upload-artifact@v7
with:
Expand All @@ -101,6 +111,11 @@ jobs:

runs-on: macos-latest

permissions:
contents: read
id-token: write
attestations: write

Comment thread
KSXGitHub marked this conversation as resolved.
strategy:
fail-fast: true
matrix:
Expand All @@ -126,6 +141,11 @@ jobs:
- name: Strip all debug symbols
run: strip target/${{ matrix.target }}/release/pdu

- name: Attest build provenance
uses: actions/attest-build-provenance@v2
with:
subject-path: target/${{ matrix.target }}/release/pdu

- name: Upload build artifact
uses: actions/upload-artifact@v7
with:
Expand All @@ -137,6 +157,11 @@ jobs:

runs-on: windows-latest

permissions:
contents: read
id-token: write
attestations: write

Comment thread
KSXGitHub marked this conversation as resolved.
strategy:
fail-fast: true
matrix:
Expand All @@ -161,6 +186,11 @@ jobs:
- name: Build
run: cargo build --target ${{ matrix.target }} --release --all-features

- name: Attest build provenance
uses: actions/attest-build-provenance@v2
with:
subject-path: target/${{ matrix.target }}/release/pdu.exe

- name: Upload build artifact
uses: actions/upload-artifact@v7
with:
Expand Down