ci: supply-chain hardening (PR 2/2) — SBOM + build-provenance attestation for releases - #43

Merged

Nelson Spence (Fieldnote-Echo) merged 4 commits into

mainfrom

ci/release-sbom-provenance

May 25, 2026

Commits on May 25, 2026

ci: release-crate provenance — harden-runner + SBOM + build attestation
Nelson Spence (Fieldnote-Echo)
committed
e320b36
ci: release-python provenance — harden-runner + SBOM + build attestation
Nelson Spence (Fieldnote-Echo)
committed
9bbd46c
ci: pin cargo-cyclonedx + fail-closed SBOM uploads (#43 review)
Nelson Spence (Fieldnote-Echo)
committed
4145425
ci: mint crates.io OIDC credential last, just before publish (#43 review)
Nelson Spence (Fieldnote-Echo)
committed
4060b87