BaaRai abb6cb177d release: add build provenance attestation, CycloneDX SBOM and a dry-run trigger ...

- release job: attest dist/*.zip with actions/attest-build-provenance
  (id-token: write, attestations: write; contents stays write for the Release).
- SBOM: syft scans the bin-linux-amd64 binary (embedded Go modules), plus
  web/package-lock.json and go.mod/go.sum; artex-<tag>.cdx.json is checked for
  pkg:golang and pkg:npm entries and attached next to SHA256SUMS.
- workflow_dispatch dry run: builds, SBOM, attestations and workflow artifacts;
  the Release step and the docker job only run on push.
- README: Verifying a release section.

2026-11-13 23:17:19 +01:00

..

scripts

Bot: quote the response_format JSON for --argjson

2026-10-10 19:19:34 +02:00

workflows

release: add build provenance attestation, CycloneDX SBOM and a dry-run trigger

2026-11-13 23:17:19 +01:00