Test Details Overview

Attest release packages and images

Every job that publishes something now asks GitHub Actions to attest
it: actions/attest signs the digests of the packages in packages/ and
of each pushed image under the workflow's OIDC identity, stores the
attestation with the repository and, for images, in the registry next
to the image. A consumer can then check that a download was built by
this workflow from the commit it names, which the .sha256 files beside
the packages cannot show since they come from the same job.

The jobs get the id-token and attestations permissions this needs, and
the package jobs publish the attestation bundle next to the packages
so it can be verified without the GitHub API.

__________

Type: commit

Hash: 7d13e73328454371c5bab0ffb906d68bda9fab10

Created: yesterday

__________

gr0v1ty/nano-node:7d13e73328454371c5bab0ffb906d68bda9fab10