ci: update workflow more securely#22

Merged

zsystm merged 3 commits into

mainfrom

Mar 3, 2026

Contributor

zsystm commented Mar 3, 2026 •

edited

Loading

Problem

Release binaries lacked cryptographic signing and build provenance, leaving no way to verify binary integrity beyond SHA256 checksums

Solution

Add cosign keyless signing and SBOM generation to GoReleaser release pipeline
Add SLSA Build L2 attestation, govulncheck, and pin all Actions to SHA
Add systemd sandboxing with dedicated user and minimum filesystem permissions
Document three-step binary verification process in README

zsystm added 3 commits

March 4, 2026 01:47


          update workflow more securely

e71e01d


          increase go version

a00f64b


          fix test

0549c44

zsystm merged commit 11cbcf5 into main

2 checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet