Skip to content

chore: complete mint adoption — release provenance + re-pin v0.3.1 #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bdelanghe merged 2 commits into from
Jun 29, 2026
Merged

chore: complete mint adoption — release provenance + re-pin v0.3.1 #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
98c52fd
chore: re-pin mint version caller to v0.3.1
bdelanghe Jun 29, 2026
36d1b45
chore: add mint release-provenance caller (v0.3.1)
bdelanghe Jun 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
name: release

# Release provenance via the bounded-systems mint capability. On a v<version> tag
# (cut by `mint release`), emits the deterministic in-toto release Statement
# (tag → version plan → commit), keyless-signs it (cosign/OIDC), and attaches it
# to the GitHub release. The registry publish stays in its existing workflow;
# this job owns VERSION + TAG provenance only. Pinned to an immutable mint commit
# SHA; bump when mint tags.
on:
push:
tags: ["v*"]

permissions:
contents: write # create / upload to the GitHub release
id-token: write # OIDC — cosign keyless signing

jobs:
release:
uses: bounded-systems/mint/.github/workflows/release-provenance.yml@v0.3.1 # mint
with:
ref: v0.3.1
6 changes: 3 additions & 3 deletions .github/workflows/version.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: version

# Versioning via the bounded-systems mint capability. Validates .release/ intents
# (fails closed on a malformed one) and previews the next version on every PR.
# Pinned to mint v0.2.0 (immutable commit SHA); bump when mint releases again.
# Pinned to an immutable mint commit SHA; bump when mint tags.
on:
push:
branches: [main]
Expand All @@ -13,6 +13,6 @@ permissions:

jobs:
version:
uses: bounded-systems/mint/.github/workflows/version.yml@440c191198bdb4c2eabb60b385e5c24cddb01e82 # v0.2.0
uses: bounded-systems/mint/.github/workflows/version.yml@v0.3.1 # mint
with:
ref: 440c191198bdb4c2eabb60b385e5c24cddb01e82
ref: v0.3.1