[dorssel]

Add release workflows

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	🟢 6.3	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 4 5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing ⚠️ 0 project is not fuzzed Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml	f7dd8c54c2067bafc12ca7a55595d5ee9b75204a	🟢 6.7	Details Check Score Reason Maintained ⚠️ 1 1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1 Code-Review 🟢 10 all changesets reviewed Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 4 dependency not pinned by hash detected -- score normalized to 4 CII-Best-Practices 🟢 5 badge detected: Passing Signed-Releases 🟢 10 5 out of the last 5 releases have a total of 5 signed artifacts. License 🟢 10 license file detected SAST 🟢 7 SAST tool detected but not run on all commits Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 2 branch protection is not maximal on development and all release branches Vulnerabilities ⚠️ 0 239 existing vulnerabilities detected CI-Tests ⚠️ 0 2 out of 28 merged PRs checked by a CI test -- score normalized to 0 Contributors 🟢 10 project has 33 contributing companies or organizations

Scanned Files

• .github/workflows/slsa.yml

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (e0a0db8) to head (b9e0c50).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #138   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            2         2           
  Lines           37        37           
  Branches         3         3           
=========================================
  Hits            37        37           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[Copilot]

🟡 Changes recommended

Both workflows contain critical blockers that prevent successful execution.

2 open issues

• Unsupported case() expression rejects the workflow · New
• Default builder path cannot use the pinned non-tag SHA · New

What changed in this PR

Adds GitHub Actions workflows for NuGet publishing and SLSA provenance generation.

Changes:

• Publishes release packages to NuGet.
• Generates and uploads provenance for release assets.
• Supports release-triggered and manual workflows.

File	Summary	Findings
.github/​workflows/​nuget.yml	Publishes release packages to NuGet.	Critical: unsupported case() expression prevents execution (4 votes).
.github/​workflows/​slsa.yml	Generates and uploads SLSA provenance.	Critical: the pinned SHA cannot use the default builder path (4 votes).

_{Review effort: Lite}

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Max errors	Warnings	Elapsed time
✅ ACTION	actionlint	8		0		0	0.09s
✅ ACTION	zizmor	8		0		0	2.98s
✅ EDITORCONFIG	editorconfig-checker	48		0		0	0.04s
✅ JSON	jsonlint	2		0		0	0.08s
✅ JSON	prettier	2		0		0	0.33s
✅ JSON	v8r	2		0		0	3.96s
✅ MARKDOWN	markdownlint	2		0		0	0.53s
✅ MARKDOWN	markdown-table-formatter	2		0		0	0.23s
✅ REPOSITORY	betterleaks	yes		no		no	0.71s
✅ REPOSITORY	checkov	yes		no		no	22.54s
✅ REPOSITORY	git_diff	yes		no		no	0.01s
✅ REPOSITORY	grype	yes		no		no	113.11s
✅ REPOSITORY	osv-scanner	yes		no		no	0.54s
✅ REPOSITORY	secretlint	yes		no		no	1.05s
✅ REPOSITORY	syft	yes		no		no	2.53s
✅ REPOSITORY	trivy-sbom	yes		no		no	0.66s
✅ REPOSITORY	trufflehog	yes		no		no	5.2s
✅ XML	xmllint	14		0		0	0.14s
✅ YAML	prettier	13		0		0	0.71s
✅ YAML	v8r	13		0		0	12.76s
✅ YAML	yamllint	13		0		0	0.66s

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

[Copilot]

🟡 Changes recommended

The NuGet workflow does not trigger for normal published releases.

1 open issue

• Trigger NuGet publishing on release publication · New

2 resolved since last review

• Default builder path cannot use the pinned non-tag SHA
• Unsupported case() expression rejects the workflow

_{Review effort: Lite}

[Copilot]

🔵 Needs a closer look

Release and provenance workflows require final human review.

No open issues 🎉

1 resolved since last review

• Trigger NuGet publishing on release publication

_{Review effort: Lite}

[Copilot]

🟢 Approved

No unresolved blocking issues remain after accounting for the intentional SLSA branch workaround and developer clarifications.

No open issues 🎉

_{Review effort: Balanced}