From fb0a847006180544321e6037dadfa6a6ee7f5b7d Mon Sep 17 00:00:00 2001 From: David Buzinski Date: Wed, 20 May 2026 14:04:16 -0400 Subject: [PATCH 1/3] add attestations --- .github/workflows/release.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9683fc6..bc1c71b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -37,6 +37,12 @@ jobs: - name: Perform npm tasks run: npm run ci + # Generate signed attestations for workflow artifacts + - name: Attest build provenance + uses: actions/attest@v4 + with: + subject-path: dist/bin/**/run-matlab-command* + # Finally, create a detached commit containing the built artifacts and tag # it with the release. Note: the fact that the branch is locally updated # will not be relayed (pushed) to origin From 453b5edd6abd8316bfc97c7a8b92ab8e5f2597ea Mon Sep 17 00:00:00 2001 From: David Buzinski Date: Wed, 20 May 2026 14:09:11 -0400 Subject: [PATCH 2/3] update comment --- .github/workflows/release.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bc1c71b..b93d475 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -37,8 +37,7 @@ jobs: - name: Perform npm tasks run: npm run ci - # Generate signed attestations for workflow artifacts - - name: Attest build provenance + - name: Generate signed attestations for workflow artifacts uses: actions/attest@v4 with: subject-path: dist/bin/**/run-matlab-command* From a790e8049c381e95be43ff7de178b4f8da524702 Mon Sep 17 00:00:00 2001 From: David Buzinski Date: Wed, 20 May 2026 14:27:31 -0400 Subject: [PATCH 3/3] update permissions --- .github/workflows/release.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b93d475..77070d2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,6 +4,9 @@ on: types: published permissions: contents: write + id-token: write + attestations: write + artifact-metadata: write jobs: build: