Publish signed releases with build provenance and an SBOM

[himanshu231204]

Problem

Releases publish to PyPI via Trusted Publishing, which is already a strong story — no long-lived tokens. But there's nothing linking the artifact on PyPI back to the commit that produced it, and no machine-readable dependency inventory.

For a tool whose pitch is "this runs on your machine and touches nothing", being able to verify what you installed is very much the point. It's also the first thing a security review at a larger organisation asks for.

What to build

• Build provenance attestation via actions/attest-build-provenance, so the wheel and sdist can be traced to the workflow run and commit
• An SBOM (CycloneDX or SPDX) generated at build time and attached to the GitHub Release
• Both published as release assets, and the verification command documented
• RELEASE.md updated with how to verify an artifact
• SECURITY.md updated — supply chain is already named as in-scope there

Acceptance criteria

• gh attestation verify succeeds against a published wheel
• The SBOM lists the runtime dependency tree (fastmcp, fastembed, and their transitives)
• Neither step requires a secret — this must stay OIDC-only
• The release workflow still fails closed: if attestation fails, publishing doesn't proceed

Notes

The workflow filename must stay release.yml — the PyPI trusted publisher is bound to it, and renaming breaks publishing entirely. See the prerequisites section of RELEASE.md.

Worth checking whether PyPI's own attestation support (PEP 740) covers part of this, in which case pypa/gh-action-pypi-publish may do the work already and this becomes mostly a documentation and SBOM task.

Pointers

• .github/workflows/release.yml — two jobs; the publish job is the one with id-token: write
• RELEASE.md