build(release): bind reviewed source to SBOM and provenance evidence - #164

Draft

seonghobae wants to merge 13 commits into

agent/rust-toolchain-refresh-2026-08-19from

codex/release-evidence-foundation-20260904

Commits on Sep 3, 2026

test(release): require immutable release evidence contract
seonghobae
committed
bf6ba08
build(release): generate source-bound SBOM and provenance evidence
seonghobae
committed
5ce56d1
docs(release): trace source-bound evidence design
seonghobae
committed
e2c51dd
docs(changelog): record release evidence foundation
seonghobae
committed
f90e931
test(release): require dependency-aware package SBOM
seonghobae
committed
26541c9
fix(release): bind SBOM to packaged dependency manifests
seonghobae
committed
2bacb6c
test(release): isolate attestation authority from PR builds
seonghobae
committed
ea56a03
fix(release): isolate attestation authority from PR execution
seonghobae
committed
c3b450e
test(release): require least-privilege attestation permissions
seonghobae
committed
3634074
fix(release): drop unused artifact-metadata authority
seonghobae
committed
b040c87
test(release): reject runner context in job-level env
seonghobae
committed
3a34d35
fix(release): move runner paths into step scope
seonghobae
committed
1d3f5a4

Commits on Sep 4, 2026

fix(release): satisfy release contract rustfmt
codex
committed
f5eb6d3