Linus Rath 569c796522 ci: sign published images and release files with build provenance ...

Nothing showed where a published image or download came from, and the
standalone tarballs had no checksum at all. Anyone who could swap a
release asset could swap its `.sha256` with it.

- every published image (release, `-always`, beta/dev and Lite) gets a
  signed build provenance attestation, pushed to GHCR next to it
- the Lite zips and standalone tarballs are attested as well
- standalone tarballs get a `.sha256`, like the Lite zips
- the tarball build no longer holds a write token: a separate release
  job, which runs no checked-out code, checksums, attests and uploads
- the README says how to check with `gh attestation verify`

2026-09-27 15:22:17 +02:00

..

deploy-demo.yml

ci: deploy demo.bulwarkmail.org from here instead of Watchtower

2026-09-20 02:57:52 +02:00

docker-publish-lite.yml

ci: sign published images and release files with build provenance

2026-09-27 15:22:17 +02:00

docker-publish-releases.yml

ci: sign published images and release files with build provenance

2026-09-27 15:22:17 +02:00

docker-publish.yml

ci: sign published images and release files with build provenance

2026-09-27 15:22:17 +02:00

standalone-release.yml

ci: sign published images and release files with build provenance

2026-09-27 15:22:17 +02:00

static-lite.yml

ci: sign published images and release files with build provenance

2026-09-27 15:22:17 +02:00

tests.yml

feat: run the test suite in CI #647

2026-09-07 22:34:47 +02:00