From 4f6824e008a467e26137651abd5e1bd300bcc321 Mon Sep 17 00:00:00 2001
From: Raj Nakarja <raj@siliconwitchery.com>
Date: Tue, 3 Nov 2026 09:58:09 +0100
Subject: [PATCH] Publish SBOMs and provenance attestations with releases

Each release now carries an SPDX SBOM per archive and a GitHub build provenance attestation, which the README explains how to verify. Also adds a weekly govulncheck of main and the newest release, and updates nixpkgs. Part of siliconwitchery/superstack-spec#41.
---
 .github/workflows/ci.yml        |  2 ++
 .github/workflows/release.yml   |  8 +++++++
 .github/workflows/vulncheck.yml | 39 +++++++++++++++++++++++++++++++++
 .goreleaser.yaml                |  3 +++
 README.md                       |  9 ++++++++
 flake.lock                      |  6 ++---
 6 files changed, 64 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/vulncheck.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eded0f1..1887f1b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,6 +54,8 @@ jobs:
       - name: Check for known vulnerabilities
         run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
 
+      - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+
       - name: Build the release the same way a tag would
         uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4950eae..0cc90c0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 concurrency:
   group: release-${{ github.ref }}
@@ -65,6 +67,8 @@ jobs:
             exit 1
           fi
 
+      - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+
       - uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           distribution: goreleaser
@@ -74,3 +78,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
           AUR_KEY: ${{ secrets.AUR_KEY }}
+
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-checksums: dist/checksums.txt
diff --git a/.github/workflows/vulncheck.yml b/.github/workflows/vulncheck.yml
new file mode 100644
index 0000000..e84b6b5
--- /dev/null
+++ b/.github/workflows/vulncheck.yml
@@ -0,0 +1,39 @@
+name: vulncheck
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      CGO_ENABLED: 0
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Check main
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
+
+      # GOTOOLCHAIN=auto switches Go to the release's own toolchain, so this
+      # checks the standard library that users run.
+      - name: Check the newest release
+        if: success() || failure()
+        env:
+          GOTOOLCHAIN: auto
+        run: |
+          tag=$(git tag -l 'v*' | sort -V | tail -1)
+          echo "Checking $tag"
+          git checkout --quiet "$tag"
+          go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index f71bde4..621b9f2 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -46,6 +46,9 @@ archives:
 checksum:
   name_template: checksums.txt
 
+sboms:
+  - artifacts: archive
+
 changelog:
   disable: true
 
diff --git a/README.md b/README.md
index f5b8252..26ada3b 100644
--- a/README.md
+++ b/README.md
@@ -38,6 +38,15 @@ a single static binary for managing Superstack from a terminal.
   [releases page](https://github.com/siliconwitchery/superstack-cli/releases),
   unpack it, and move `superstack` onto your `PATH`. Repeat to update.
 
+To check that a downloaded archive was built from this repository by its
+release workflow, run this with the [GitHub CLI](https://cli.github.com):
+
+```sh
+gh attestation verify <archive> --repo siliconwitchery/superstack-cli
+```
+
+Each archive's release also carries its SBOM, `<archive>.sbom.json`.
+
 ## Local development
 
 1. Clone the repository:
diff --git a/flake.lock b/flake.lock
index e6c5530..8efe688 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1785989512,
-        "narHash": "sha256-HFQhkQcl5D1hUNoen3SGHCSFCt2Bg6uP+HgbrnA3InQ=",
+        "lastModified": 1793633738,
+        "narHash": "sha256-tItrb9M8eYA6WhFgmT9tpGKueri3+wRuVA952o/2xSU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "445d861c6d31b4af0c79d8d4be2331f762a361d7",
+        "rev": "7dcdd87373d72e7a2173e4db02e20d3d7f495cfd",
         "type": "github"
       },
       "original": {