ci: attest release artifacts before publication

[seonghobae]

Purpose

Clean current-main replacement for stale stacked PR #138. Make buyer-verifiable release provenance and exact release-version admission first-class release gates without carrying #137 ancestry or overlapping #147's Test/coverage workflow ownership.

Test-first state

Exact base at branch creation: 4b2f5d30c1f1961e017a84aa1c785d3f1b1bb9af.

Initial RED head: 1700a3d438c89abca4309331a1f4a17520080c92.

The RED requires a cross-platform release-version verifier and packaging hook that protected main does not yet implement. Subsequent commits will reconstruct only the release-owned workflow, admission tests, executable verifier, doctoring, and changelog from current main. .github/workflows/test.yml and generic coverage configuration remain owned by #147 and are intentionally excluded to avoid duplicated control-plane edits.

Intended authority boundary

• platform build jobs remain repository-read-only;
• tag-only attestation gets contents: read, id-token: write, and attestations: write but no publication authority;
• tag-only publication gets contents: write only after successful attestation;
• exact artifact namespaces remain unflattened so duplicate basenames remain observable;
• exactly five GUI bundles, six operational CLIs, and six adjacent checksum records are admitted; unexpected or non-regular entries fail closed;
• release tags must exactly match the common SemVer in package.json, Cargo.toml, and tauri.conf.json;
• no stale ci: attest release artifacts before publication #138 check/review/approval evidence transfers.

Keep Draft until production implementation, deterministic tests, current-head Release/Test/security/SAST, exact coverage integration, review findings, and live repository policy are satisfied.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d0ad8a2c-69d2-4601-9767-1c7c34ee85d9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by current-protected-main Draft #154, reconstructed from protected main at 7a86b3dae0c941bc59edfde146c9d7498a0c75a0 without transferring stale checks, reviews, approvals, or merge-tree evidence.

Convergence proof: #151 and #154 change the same nine repository paths, and all nine #154 blobs match #151 byte-for-byte: .github/workflows/release.yml (52d4599…), CHANGELOG.md (3ef1be8…), both release doctoring documents (b74e5cd…, baf6130…), package.json (5751fd1…), scripts/ci/release-version.mjs (bb5cedc…), and the three release contract tests (2c574a3…, 4f60f5f…, 860b8c9…).

#151 remains non-mergeable on stale base snapshot 4b2f5d30c1f1961e017a84aa1c785d3f1b1bb9af; #154 is the single current-base owner. Closing #151 as technically superseded, not merged.