[wenju-he]

Attach a source archive to each patch release together with a sigstore signature (.sigstore.json) and SLSA build provenance (.intoto.jsonl), to address the OpenSSF Scorecard Signed-Releases check.

Tested on a fork: the release job succeeded and the provenance bundle passed gh attestation verify.

[Copilot]

🟡 Changes recommended

Provenance references the wrong source commit, and failures can leave releases permanently unsigned.

3 open findings

• Unpinned Sigstore package runs with release-write token · New
• Release publishes before signing, preventing repair on retry · New
• Maintenance archives attest against the wrong commit · New

What changed in this PR

Adds signed source archives and SLSA provenance to patch releases.

Changes:

• Grants signing and attestation permissions.
• Generates Sigstore signatures and provenance bundles.
• Uploads artifacts to GitHub Releases.

File	Description
.github/​workflows/​patch-release.yml	Adds release artifact signing, provenance, and upload steps.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The privileged release job dynamically executes unhashed Python dependencies, creating a supply-chain risk.

1 open finding

• Pin Sigstore dependencies to prevent release-path supply-chain compromise · New

3 resolved since last review

• Unpinned Sigstore package runs with release-write token
• Maintenance archives attest against the wrong commit
• Release publishes before signing, preventing repair on retry

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Scheduled runs generate provenance using a build type that explicitly excludes the schedule event.

0 open findings

1 resolved since last review

• Pin Sigstore dependencies to prevent release-path supply-chain compromise

Previously missed (1)

In code that hasn't changed since last review

Monthly schedule uses unsupported workflow/v1 event_name

.github/​workflows/​patch-release.yml:135

The monthly schedule path sets event_name to schedule, but the workflow/v1 build-type specification supports only create, release, push, and workflow_dispatch, and explicitly forbids using this build type for other events. Scheduled releases therefore publish semantically nonconforming provenance even though gh attestation verify can validate its signature. Route the scheduled build through a supported event or use and document a schedule-aware build type.

🧠 Review effort: Balanced