BaaRai abb6cb177d release: add build provenance attestation, CycloneDX SBOM and a dry-run trigger ...

- release job: attest dist/*.zip with actions/attest-build-provenance
  (id-token: write, attestations: write; contents stays write for the Release).
- SBOM: syft scans the bin-linux-amd64 binary (embedded Go modules), plus
  web/package-lock.json and go.mod/go.sum; artex-<tag>.cdx.json is checked for
  pkg:golang and pkg:npm entries and attached next to SHA256SUMS.
- workflow_dispatch dry run: builds, SBOM, attestations and workflow artifacts;
  the Release step and the docker job only run on push.
- README: Verifying a release section.

2026-11-13 23:17:19 +01:00

..

bot.yml

Bot: label maintainer-opened issues, silently

2026-10-10 18:46:31 +02:00

ci.yml

release: build release body from CHANGELOG section

2026-11-12 12:43:10 +01:00

release.yml

release: add build provenance attestation, CycloneDX SBOM and a dry-run trigger

2026-11-13 23:17:19 +01:00