From d9cdc06e06e3996543998c9f5fce408d8e3269c4 Mon Sep 17 00:00:00 2001
From: marcmy <21000174+marcmy@users.noreply.github.com>
Date: Wed, 14 Oct 2026 14:49:27 -0400
Subject: [PATCH] ci: attest packaged release artifacts before publication

---
 .github/workflows/release.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 65b1599c..dcf95f72 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -417,6 +417,11 @@ jobs:
   publish:
     needs: prepare-release
     runs-on: windows-2022
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     env:
       RELEASE_TAG: ${{ needs.prepare-release.outputs.release_tag }}
       RELEASE_VERSION: ${{ needs.prepare-release.outputs.release_version }}
@@ -493,6 +498,10 @@ jobs:
               "$($hash.Hash.ToLower())  $relativePath"
             } | Set-Content -Encoding ASCII SHA256SUMS.txt
 
+      - name: Attest installer artifacts before publication
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: out/make/**/*
       - name: Generate release notes from changelog
         shell: pwsh
         run: |