Skip to content

feat(release): add build provenance attestations after goreleaser #138

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mvanhorn wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(release): add build provenance attestations after goreleaser #138

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 11 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,10 @@ on:

# Minimal permissions — only grant what's needed.
permissions:
contents: write # create GitHub releases & upload assets
id-token: write # OIDC token for keyless cosign signing
packages: write # push Docker images
contents: write # create GitHub releases & upload assets
id-token: write # OIDC token for keyless cosign signing
packages: write # push Docker images
attestations: write # generate build provenance attestations

jobs:
release:
Expand Down Expand Up @@ -59,3 +60,10 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
HOMEBREW_TAP_TOKEN: ${{ secrets.GO_RELEASER_GITHUB_TOKEN }}

- name: Generate build provenance attestations
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
with:
subject-path: |
dist/*.tar.gz
dist/checksums.txt
10 changes: 10 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,16 @@ agent-vault server -d

The server starts the HTTP API on port `14321` and a TLS-encrypted transparent HTTPS proxy on port `14322`. A web UI is available at `http://localhost:14321`.

### Verifying downloaded release binaries

Release archives published from this workflow ship with a build provenance attestation tied to the GitHub Actions run that produced them. Verify with the `gh` CLI (no extra tools, no key management):

```bash
gh attestation verify agent-vault_*.tar.gz --repo Infisical/agent-vault
```

`checksums.txt` is also covered by the same attestation, and its cosign signature continues to verify with `cosign verify-blob` for users who prefer that path.

## Quickstart

### CLI — local agents (Claude Code, Cursor, Codex, OpenClaw, Hermes, OpenCode)
Expand Down