From 2d37e4997056f1de95896d9948a14ea91d680eb6 Mon Sep 17 00:00:00 2001 From: Daniel Roe Date: Tue, 16 Sep 2025 22:13:17 +0100 Subject: [PATCH 1/2] ci: add provenance action to check for downgrades in provenance --- .github/workflows/provenance.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/workflows/provenance.yml diff --git a/.github/workflows/provenance.yml b/.github/workflows/provenance.yml new file mode 100644 index 00000000..21f2efe2 --- /dev/null +++ b/.github/workflows/provenance.yml @@ -0,0 +1,23 @@ + +name: ci + +on: + push: + branches: + - main + pull_request: + branches: + - main +permissions: + contents: read +jobs: + check-provenance: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: Check provenance downgrades + uses: danielroe/provenance-action@a5a718233ca12eff67651fcf29a030bbbd5b3ca1 # v0.1.0 + with: + fail-on-provenance-change: true From 589fef044691d3a226c7240c17cf51b15a61aabc Mon Sep 17 00:00:00 2001 From: Daniel Roe Date: Tue, 16 Sep 2025 22:25:06 +0100 Subject: [PATCH 2/2] chore: lint --- .github/workflows/provenance.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/provenance.yml b/.github/workflows/provenance.yml index 21f2efe2..ab7192a3 100644 --- a/.github/workflows/provenance.yml +++ b/.github/workflows/provenance.yml @@ -1,4 +1,3 @@ - name: ci on: