Skip to content

fix: SLSA provenance to package releases #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jplomas merged 1 commit into from
May 4, 2026
Merged

fix: SLSA provenance to package releases #42

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,7 +220,8 @@ jobs:
dist/checksums-sha512.txt \
dist/sbom-spdx.json \
dist/sbom-cyclonedx.json \
--clobber
--clobber \
--repo "${GITHUB_REPOSITORY}"
done < dist/released-packages.tsv

slsa-subjects:
Expand Down Expand Up @@ -285,5 +286,6 @@ jobs:
while IFS=$'\t' read -r _package_path _package_name _package_version release_tag _tarball_name; do
gh release upload "${release_tag}" \
dist/provenance.intoto.jsonl \
--clobber
--clobber \
--repo "${GITHUB_REPOSITORY}"
done < dist/released-packages.tsv
12 changes: 12 additions & 0 deletions RELEASE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,18 @@ Release-triggering commits:

Non-release changes should use prefixes such as `docs:`, `test:`, `ci:`, `chore:`, `refactor:`, or `style:`.

## Keeping Package Versions In Sync

`multi-semantic-release` releases packages based on committed changes in each package path. If maintainers need to deliberately keep all publishable package versions aligned, run this locally before opening the release-prep PR:

```sh
pnpm run release:touch-packages
```

This writes a package-local `.release-touch` marker into every publishable package. Commit those marker changes with a release-triggering Conventional Commit such as `fix(release): refresh package release markers`. The marker files are intentionally outside the package `files` allowlists and are excluded from npm tarballs.

Do not run `release:touch-packages` inside the release workflow. Uncommitted files created by CI are not part of the commit history analyzed by semantic-release and should not be used to force package releases.

## Pre-Release Requirements

Before setting `RELEASES_ENABLED=true`, the release owner must confirm:
Expand Down
Loading