Skip to content

Attest exact release provenance - #39

Closed
biru-codeastromer wants to merge 3 commits into
codex/release-checksums-linear-v3from
codex/release-attestations-linear-v3
Closed

Attest exact release provenance#39
biru-codeastromer wants to merge 3 commits into
codex/release-checksums-linear-v3from
codex/release-attestations-linear-v3

Conversation

@biru-codeastromer

@biru-codeastromer biru-codeastromer commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

Summary

  • add pinned GitHub artifact provenance for the checksummed wheel and source archive
  • bind verification to the exact signer workflow, signer commit, protected tag ref, and source commit
  • verify each distribution before draft publication and again on published-release reruns
  • retain exact remote asset closure and organization-enforced immutable release verification

This supersedes #37 with a clean linear history stacked on #38.

Validation

  • local make release-gate: 111 passed, 1 optional skip, 91.83% coverage
  • hosted Python 3.11 through 3.13 coverage: 91.65%; hosted Python 3.14 coverage: 91.56%
  • clean wheel installation, dependency audit, example, repository audit, and full-history secret scan passed

@biru-codeastromer
biru-codeastromer marked this pull request as draft August 23, 2026 23:48
@biru-codeastromer
biru-codeastromer changed the base branch from codex/release-checksums-linear-v3 to main August 23, 2026 23:51
@biru-codeastromer
biru-codeastromer changed the base branch from main to codex/release-checksums-linear-v3 August 23, 2026 23:53
@biru-codeastromer
biru-codeastromer marked this pull request as ready for review August 24, 2026 00:02
@biru-codeastromer

Copy link
Copy Markdown
Contributor Author

Superseded by merged #41, which preserves this change in the protected v0.4.0 release stack.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants