Publish SBOMs and provenance attestations with releases

.github/workflows/ci.yml

@@ -54,6 +54,8 @@ jobs:
       - name: Check for known vulnerabilities
         run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
 
+      - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+
       - name: Build the release the same way a tag would
         uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:

.github/workflows/release.yml

@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 concurrency:
   group: release-${{ github.ref }}
@@ -65,6 +67,8 @@ jobs:
             exit 1
           fi
 
+      - uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+
       - uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           distribution: goreleaser
@@ -74,3 +78,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAP_GITHUB_TOKEN: ${{ secrets.TAP_GITHUB_TOKEN }}
           AUR_KEY: ${{ secrets.AUR_KEY }}
+
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-checksums: dist/checksums.txt

.github/workflows/vulncheck.yml

@@ -0,0 +1,39 @@
+name: vulncheck
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      CGO_ENABLED: 0
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Check main
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
+
+      # GOTOOLCHAIN=auto switches Go to the release's own toolchain, so this
+      # checks the standard library that users run.
+      - name: Check the newest release
+        if: success() || failure()
+        env:
+          GOTOOLCHAIN: auto
+        run: |
+          tag=$(git tag -l 'v*' | sort -V | tail -1)
+          echo "Checking $tag"
+          git checkout --quiet "$tag"
+          go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...

.goreleaser.yaml

@@ -46,6 +46,9 @@ archives:
 checksum:
   name_template: checksums.txt
 
+sboms:
+  - artifacts: archive
+
 changelog:
   disable: true
 

README.md

@@ -38,6 +38,15 @@ a single static binary for managing Superstack from a terminal.
   [releases page](https://github.com/siliconwitchery/superstack-cli/releases),
   unpack it, and move `superstack` onto your `PATH`. Repeat to update.
 
+To check that a downloaded archive was built from this repository by its
+release workflow, run this with the [GitHub CLI](https://cli.github.com):
+
+```sh
+gh attestation verify <archive> --repo siliconwitchery/superstack-cli
+```
+
+Each archive's release also carries its SBOM, `<archive>.sbom.json`.
+
 ## Local development
 
 1. Clone the repository: