Add GitHub artifact attestations for release APKs (#30)
Add actions/attest-build-provenance@v2 to both CI and release
workflows to generate signed SLSA provenance attestations for APK
artifacts. This lets users verify that release APKs were built by
GitHub Actions from this repository.
- build-release.yml: attest APK before creating draft release
- ci.yml: attest APK in release job before creating release
- Add required id-token:write and attestations:write permissions
https://claude.ai/code/session_0119yDDWLdCefdrFfwSAnsuL
Co-authored-by: Claude <noreply@anthropic.com>
commite8385c803f6091e3609a4573985aed6783f8aec4
authoriko <mail@iko.soy>
dateFri 20 Feb 2026, 18:03 (7 months ago)
parent6b6d13f
.github/workflows/build-release.yml+7
@@ -12,6 +12,8 @@ concurrency:
1212
1313permissions:
1414 contents: write
15+ id-token: write
16+ attestations: write
1517
1618jobs:
1719 build:
@@ -60,6 +62,11 @@ jobs:
6062 name: parseable-android-release
6163 path: app/build/outputs/apk/release/*.apk
6264
65+ - name: Attest release APK
66+ uses: actions/attest-build-provenance@v2
67+ with:
68+ subject-path: app/build/outputs/apk/release/*.apk
69+
6370 - name: Create Draft Release
6471 if: startsWith(github.ref, 'refs/tags/v')
6572 uses: softprops/action-gh-release@v2
.github/workflows/ci.yml+7
@@ -79,6 +79,8 @@ jobs:
7979 cancel-in-progress: false
8080 permissions:
8181 contents: write
82+ id-token: write
83+ attestations: write
8284
8385 steps:
8486 - name: Checkout code
@@ -124,6 +126,11 @@ jobs:
124126 mv "$apk" "app/build/outputs/apk/release/parseable-android-${VERSION_NAME}.apk"
125127 done
126128
129+ - name: Attest release APK
130+ uses: actions/attest-build-provenance@v2
131+ with:
132+ subject-path: app/build/outputs/apk/release/*.apk
133+
127134 - name: Create release
128135 uses: softprops/action-gh-release@v2
129136 with: