ci: attest build provenance and SBOM for releases

.github/workflows/release.yml

@@ -12,6 +12,10 @@ jobs:
   release:
     name: Build and publish release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
 
     steps:
       - name: Check out repository
@@ -53,6 +57,35 @@ jobs:
             --notes-file "docs/releases/$GITHUB_REF_NAME.md" \
             --title "Bible CLI $GITHUB_REF_NAME"
 
+      - name: Generate SBOM
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+        with:
+          path: .
+          format: spdx-json
+          output-file: dist/bible-cli.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: |
+            dist/bible-cli_*.tar.gz
+            dist/checksums.txt
+
+      - name: Attest SBOM
+        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
+        with:
+          subject-path: |
+            dist/bible-cli_*.tar.gz
+            dist/checksums.txt
+          sbom-path: dist/bible-cli.spdx.json
+
+      - name: Upload SBOM to release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release upload "$GITHUB_REF_NAME" dist/bible-cli.spdx.json --clobber
+
       - name: Check Homebrew tap credentials
         if: ${{ !contains(github.ref_name, '-') }}
         id: homebrew-token

docs/INSTALL.md

@@ -45,6 +45,14 @@ install -m 0755 bible ~/.local/bin/bible
 On Linux, use `sha256sum --check -` in place of the `shasum` verification
 command.
 
+Each release asset also has a signed build-provenance attestation (SLSA) and an
+SPDX software bill of materials. With the GitHub CLI, verify that an archive was
+built by this repository's release workflow:
+
+```console
+gh attestation verify bible-cli_0.1.0_darwin_arm64.tar.gz --repo vmrocha/bible-cli
+```
+
 Ensure `~/.local/bin` is on your `PATH`, then verify the embedded release
 metadata and read a verse:
 

docs/RELEASING.md

@@ -45,11 +45,14 @@ not update Homebrew.
 ## Verify
 
 1. Wait for the release workflow to complete successfully.
-2. Confirm the GitHub release contains four archives and `checksums.txt`.
+2. Confirm the GitHub release contains four archives, `checksums.txt`, and
+   `bible-cli.spdx.json`, and that build provenance was attested.
 3. Download the archive for the current machine and verify its checksum.
-4. Run `bible version` and confirm the version, commit, and build date.
-5. Run `bible read "John 3:16"` without network access.
-6. Confirm the tap formula references the new tag, then run
+4. Verify the archive's build provenance:
+   `gh attestation verify <archive> --repo vmrocha/bible-cli`.
+5. Run `bible version` and confirm the version, commit, and build date.
+6. Run `bible read "John 3:16"` without network access.
+7. Confirm the tap formula references the new tag, then run
    `brew update && brew upgrade bible-cli` and `brew test bible-cli`.
 
 Never move or reuse a published tag. If publishing fails after a release becomes

website/guide/installation.md

@@ -22,7 +22,8 @@ Homebrew also installs Bash, Zsh, and Fish completions. Use
    on your `PATH`.
 
 See the repository's [full installation guide](https://github.com/vmrocha/bible-cli/blob/main/docs/INSTALL.md)
-for platform-specific commands, source builds, and checksum verification.
+for platform-specific commands, source builds, checksum verification, and
+build-provenance (SLSA) verification.
 
 ## Confirm the installation