Attest build provenance, which needs no key of ours at all

[las7]

The industry-standard half of this problem that we were leaving on the table, and it is free.

Why this and not more signing

A Developer ID signature says Reachpad signed this. It says nothing about what was signed or where it came from, and it rests on a private key somebody could steal — which is the failure the environment gating in #8 is designed to survive rather than prevent.

Build provenance is the complement, and it is the half Apple cannot give us: a signed statement that these exact bytes came out of this workflow, at this commit, in this repository. The signing identity is a short-lived OIDC credential GitHub mints for that one run, and the record goes into a public transparency log. There is no long-lived secret, so there is nothing to steal, rotate, or revoke.

It also covers the Linux tarballs, which have no Gatekeeper and would therefore never have been signed by anything at all.

gh attestation verify reachpad-<target>.tar.gz --repo Reachpad/reachpad-cli

What changed

• publish job gains id-token: write and attestations: write, and runs actions/attest-build-provenance@v4 over *.tar.gz.
• The release body and the repo README both document the verify command. A verification nobody is told about is one nobody performs.

Free on public repositories.

Note

We already do the equivalent on the npm side — Trusted Publishing over OIDC, no token in the repository, provenance attached automatically. This brings the GitHub release assets up to the same standard, so the two distribution channels make the same promise.