@@ -21,6 +21,8 @@ jobs:
2121 runs-on: ubuntu-latest
2222 permissions:
2323 contents: write # required to push the tag and create the release
24+ id-token: write # required for OIDC so GitHub can sign the attestation
25+ attestations: write # required to publish the attestation record
2426 steps:
2527 - uses: actions/checkout@v4
2628 with:
@@ -73,6 +75,17 @@ jobs:
7375 APK="$(find app/build/outputs/apk -name '*.apk' | head -n1)"
7476 cp "$APK" "staging/opencode-${{ steps.version.outputs.version }}.apk"
7577
78+ # Generate a signed build-provenance attestation for the staged APK and
79+ # store it in GitHub's artifact attestation store, keyed by the file's
80+ # digest. Anyone can later verify the APK's origin/provenance with
81+ # `gh attestation verify` -- its repository & workflow. Run *after*
82+ # staging and *before* the release is published so the attested subject
83+ # is byte-identical to the artifact attached to the release.
84+ - name: Attest build provenance
85+ uses: actions/attest-build-provenance@v2
86+ with:
87+ subject-path: staging/*.apk
88+
7689 - name: Create release
7790 uses: softprops/action-gh-release@v2
7891 with: