fix: bind Sigstore provenance to admitted workload - #2847

Merged

ascorbic merged 7 commits into

mainfrom

fix/sigstore-workload-identity-binding

Sep 2, 2026

Commits on Sep 2, 2026

fix(release-service): bind provenance to workload identity
ascorbic
committed
cabc840
fix(release-service): distinguish workflow and run refs
ascorbic
committed
c2125e1
test(release-service): clarify workflow identity fixtures
ascorbic
committed
05140e9
merge main and consolidate workload identity fixture
ascorbic
committed
4d0faa4
fix(release-service): preserve GitHub repository casing
ascorbic
committed
0f84214
merge current delegated-release security fixes
ascorbic
committed
f7a9390
refactor(release-service): consolidate workload identity parsing
ascorbic
committed
8e85dda