feat(ci): sign + SBOM + SLSA L3 provenance for images and tarballs#257

Merged

Cre-eD merged 16 commits into

mainfrom

feat/phase2-attestation

May 16, 2026

Commits on May 13, 2026

feat(ci): sign + SBOM + SLSA L3 provenance for images and tarballs
Cre-eD
committed

Commits on May 15, 2026

fix(ci): address round-1 review (gh attestation verify, digest TOCTOU, staging split)
Cre-eD
committed
fix(ci): round-2 review — drop staging matrix entry, gh attestation --repo
Cre-eD
committed
fix(ci): round-3 review — installer best-effort, drop staging dep from docker-finalize
Cre-eD
committed
perf+feat(ci): verify-attestations off critical path; cover branch-preview.yaml
Cre-eD
committed
fix(ci): drop push-to-registry from attest-build-provenance (SBOM was overwritten)
Cre-eD
committed
fix(ci): SBOM sidecar filename → <tarball>.sbom.cdx.json (was missing .tar.gz)
Cre-eD
committed
fix(ci): tighten verify-attestations.yml trust-root + add SBOM verify (round-4 review)
Cre-eD
committed
fix(docs+ci): thorough-review findings — consumer-facing doc accuracy + step-output for VERSION
Cre-eD
committed
chore(docs): move SECURITY.md to docs/
Cre-eD
committed
feat(test): scripts/verify-preview.sh + negative_tests workflow input
Cre-eD
committed
fix(test): drop unused `require_tool crane` from verify-preview.sh
Cre-eD
committed