Add build provenance and artifact verification to releases

[knytcomics-ui]

Category

Advanced

Summary

Make published extension archives verifiable against reviewed source and CI output.

Current Behavior

release.yml builds a ZIP and publishes it through GitHub Releases, but does not generate provenance attestations, checksums, SBOM metadata, or an independent verification step.

Problem

Users and maintainers cannot independently verify how a release archive was produced.

Why This Matters

The extension has broad page access and sits in a security-critical signing flow; build compromise could undermine runtime controls.

Proposed Scope

Generate checksums, provenance attestations, and dependency metadata. Verify tag/version consistency and document artifact verification.

Acceptance Criteria

• Every release includes an archive checksum.
• CI produces provenance tied to commit and workflow.
• Tag/version consistency is checked before publishing.
• Artifact reproducibility or remaining nondeterminism is documented.
• Maintainer verification instructions are published.
• Workflow permissions remain least-privilege.

Technical Considerations

Relevant files: .github/workflows/release.yml, scripts/package-release.mjs, scripts/check-versions.mjs, and package-lock.json.

Testing Requirements

Exercise tag and manual releases, checksum mismatch detection, and artifact-content inspection.

Cross-Repository Impact

None identified.

Out of Scope

Chrome Web Store submission automation or runtime permission changes.

Complexity

Advanced — supply-chain security, CI identity, and release policy.

Impact

Critical — protects distribution of a security-sensitive extension.

Suggested Labels

advanced, security, ci-cd

[Hollujay]

I would like to work on this issue because I will get it done @knytcomics-ui