Reusable release workflows for projects. Every release built here ships with SLSA Build Level 3 provenance and keyless Sigstore signatures — no per-project secrets or signing-key management. Per-artifact SBOM attestation is on the roadmap.
GitHub artifact attestations generated inside a project's own workflow reach SLSA Build Level 2: the provenance is real, but it is produced by the same workflow a compromised repository could edit. Level 3 requires the provenance to be generated somewhere the build cannot reach — a shared, vetted, isolated workflow whose identity a tenant build cannot impersonate.
This repository is that workflow. Projects delegate their release to it with a single uses: call, and consumers gain something stronger than "this artifact has provenance": they can verify that a release was built by this specific pipeline, at a known commit, from a known source revision — and reject anything that wasn't.
Centralising the release path has a second benefit that has nothing to do with attestations: there is exactly one place where release security is implemented, reviewed, and improved. A hardening change lands here once and every project inherits it on its next release.
| Workflow | Purpose | Caller contract |
|---|---|---|
| release-rust | Build, attest, and release Rust binaries | docs/release-rust.md |
The contract documents define everything callers may rely on — usage, inputs, outputs, supported targets, archive naming, attestation subjects, adoption steps, and how to verify what was produced — and change only under the versioning rules in RELEASE.md.
Pin the full commit SHA of whichever workflow you adopt, with the version as a trailing comment, so your dependency-update tooling (Renovate, Dependabot, ...) can propose bumps — there are no floating major tags here, by design.