Provenance attestations for release artifacts

[exploreriii]

Missing provenance attestations for release artifacts

The recent releases (e.g. v0.2.6 and v0.2.5) include Sigstore signatures for artifacts, but do not include provenance attestations.

Example:

• hiero_sdk_python-0.2.6-py3-none-any.whl.sigstore.json is present (signature)
• No provenance (SLSA / in-toto attestation) is attached

This results in warnings from verification tooling:

release artifact does not have provenance

Why this matters

Signatures verify who signed the artifact, but provenance is needed to verify how and where it was built (e.g. CI workflow, commit, environment). Without it, the supply-chain integrity is incomplete.

Suggested fix

Enable build provenance generation in CI

https://scorecard.dev/viewer/?uri=github.com/hiero-ledger/hiero-sdk-python
https://api.github.com/repos/hiero-ledger/hiero-sdk-python/releases/317205621

[github-actions]

@coderabbitai plan

[coderabbitai]

Coding Plan

Summary

• Add attestations: write permission to the existing publish-and-sign job to enable GitHub Attestations API access
• Insert actions/attest-build-provenance step to generate SLSA provenance attestations for wheel and sdist artifacts
• Explicitly enable PEP 740 attestations in the PyPI publish action for complete supply-chain integrity coverage
• All changes are confined to .github/workflows/publish.yml with minimal modification to the existing workflow structure

Design Choices

Design Choice 1: Where should the provenance attestation step be added?

Options Considered:

1. Add attestation in the build job immediately after artifact creation (semantically most accurate for provenance)
2. Add attestation in the publish-and-sign job after downloading artifacts (minimally invasive, leverages existing id-token: write permission)

Chosen Option: 2

Rationale: Adding to publish-and-sign is less invasive since it already has id-token: write permission, and the attestation will still capture accurate workflow/commit information from the GitHub Actions context.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Enable Provenance Attestation in Release Workflow

This phase modifies the existing publish workflow to generate SLSA provenance attestations for release artifacts, addressing the missing provenance that verification tooling expects.

Task 1: Add Required Permissions for Attestation

Add the attestations: write permission to enable the workflow to upload provenance attestations to GitHub's Attestations API.

• Update .github/workflows/publish.yml to add attestations: write to the publish-and-sign job's permissions block alongside existing contents: write and id-token: write

Task 2: Add Build Provenance Attestation Step

Add the actions/attest-build-provenance action to generate SLSA provenance attestations for the wheel and sdist artifacts.

• Update .github/workflows/publish.yml to add a new step using actions/attest-build-provenance in the publish-and-sign job
• Position the step after "Download distributions" and before or alongside the Sigstore signing step
• Configure the action to attest both the .whl and .tar.gz files in the dist/ directory
• Pin the action to a specific SHA for security consistency with other actions in the workflow (follow existing pattern of SHA pinning with version comment)

Task 3: Ensure PyPI Attestations Are Enabled

Verify and explicitly enable PEP 740 attestations in the PyPI publish action to ensure attestations are uploaded to PyPI alongside the package.

• Update .github/workflows/publish.yml to add attestations: true input to the pypa/gh-action-pypi-publish action step
• This makes the attestation behavior explicit rather than relying on default behavior, ensuring consistency across action version updates

🤖 Prompt for AI agents

Modify `.github/workflows/publish.yml` to add SLSA provenance attestations to
the `publish-and-sign` job. All three tasks below are changes to the same file.

**Task 1 — Add `attestations: write` permission:**
- In the `publish-and-sign` job's `permissions` block, add `attestations: write`
alongside the existing `contents: write` and `id-token: write` entries.

**Task 2 — Add the `actions/attest-build-provenance` step:**
- Add a new step in the `publish-and-sign` job using the
`actions/attest-build-provenance` action.
- Position this step after the "Download distributions" step and before or
alongside the existing Sigstore signing step.
- Configure the action to target both the `.whl` and `.tar.gz` files inside the
`dist/` directory.
- Pin the action to a specific commit SHA (following the existing workflow
pattern of SHA pinning with an inline version comment).

**Task 3 — Explicitly enable PEP 740 attestations in the PyPI publish step:**
- In the existing `pypa/gh-action-pypi-publish` step, add the `attestations:
true` input to make attestation upload behavior explicit and resilient to future
action version changes.

Research

The project uses a GitHub Actions workflow (.github/workflows/publish.yml) for releases, triggered on v*.*.* tag pushes. The workflow has two jobs: build (creates wheel and sdist using pdm-backend) and publish-and-sign (signs with Sigstore, publishes to PyPI via Trusted Publishing, and uploads to GitHub Releases). The publish-and-sign job already has id-token: write and contents: write permissions, but lacks attestations: write and does not use actions/attest-build-provenance. The pypa/gh-action-pypi-publish action is pinned to release/v1 but doesn't explicitly configure PEP 740 attestations.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Modify `.github/workflows/publish.yml` to add SLSA provenance attestations to
the `publish-and-sign` job. All three tasks below are changes to the same file.

**Task 1 — Add `attestations: write` permission:**
- In the `publish-and-sign` job's `permissions` block, add `attestations: write`
alongside the existing `contents: write` and `id-token: write` entries.

**Task 2 — Add the `actions/attest-build-provenance` step:**
- Add a new step in the `publish-and-sign` job using the
`actions/attest-build-provenance` action.
- Position this step after the "Download distributions" step and before or
alongside the existing Sigstore signing step.
- Configure the action to target both the `.whl` and `.tar.gz` files inside the
`dist/` directory.
- Pin the action to a specific commit SHA (following the existing workflow
pattern of SHA pinning with an inline version comment).

**Task 3 — Explicitly enable PEP 740 attestations in the PyPI publish step:**
- In the existing `pypa/gh-action-pypi-publish` step, add the `attestations:
true` input to make attestation upload behavior explicit and resilient to future
action version changes.

💡 Iterate on the plan with: @coderabbitai <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!

[bhuvan-somisetty]

/assign

[ManmathX]

/assign