From 98c52fde6c04988b4e6d7d1bbe81dbfa0c10aa56 Mon Sep 17 00:00:00 2001 From: Robert DeLanghe <1240090+bdelanghe@users.noreply.github.com> Date: Mon, 29 Jun 2026 02:28:19 -0400 Subject: [PATCH 1/2] chore: re-pin mint version caller to v0.3.1 Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/version.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml index 6d0a6ab..b5ac312 100644 --- a/.github/workflows/version.yml +++ b/.github/workflows/version.yml @@ -2,7 +2,7 @@ name: version # Versioning via the bounded-systems mint capability. Validates .release/ intents # (fails closed on a malformed one) and previews the next version on every PR. -# Pinned to mint v0.2.0 (immutable commit SHA); bump when mint releases again. +# Pinned to an immutable mint commit SHA; bump when mint tags. on: push: branches: [main] @@ -13,6 +13,6 @@ permissions: jobs: version: - uses: bounded-systems/mint/.github/workflows/version.yml@440c191198bdb4c2eabb60b385e5c24cddb01e82 # v0.2.0 + uses: bounded-systems/mint/.github/workflows/version.yml@v0.3.1 # mint with: - ref: 440c191198bdb4c2eabb60b385e5c24cddb01e82 + ref: v0.3.1 From 36d1b45a83494b7131aa47e9144bb7abb2b92335 Mon Sep 17 00:00:00 2001 From: Robert DeLanghe <1240090+bdelanghe@users.noreply.github.com> Date: Mon, 29 Jun 2026 02:28:20 -0400 Subject: [PATCH 2/2] chore: add mint release-provenance caller (v0.3.1) Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..c36a4c1 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,21 @@ +name: release + +# Release provenance via the bounded-systems mint capability. On a v tag +# (cut by `mint release`), emits the deterministic in-toto release Statement +# (tag → version plan → commit), keyless-signs it (cosign/OIDC), and attaches it +# to the GitHub release. The registry publish stays in its existing workflow; +# this job owns VERSION + TAG provenance only. Pinned to an immutable mint commit +# SHA; bump when mint tags. +on: + push: + tags: ["v*"] + +permissions: + contents: write # create / upload to the GitHub release + id-token: write # OIDC — cosign keyless signing + +jobs: + release: + uses: bounded-systems/mint/.github/workflows/release-provenance.yml@v0.3.1 # mint + with: + ref: v0.3.1