include provenance and additional docs

Author: jsonbailey

.github/workflows/ci.yml

@@ -1,11 +1,11 @@
 name: Run CI
 on:
   push:
-    branches: [ main ]
+    branches: [ main, 'feat/**' ]
     paths-ignore:
       - '**.md' # Do not need to run CI for markdown changes.
   pull_request:
-    branches: [ main ]
+    branches: [ main, 'feat/**' ]
     paths-ignore:
       - '**.md'
 

.github/workflows/publish.yml

@@ -68,4 +68,3 @@ jobs:
       base64-subjects: "${{ needs.build-publish.outputs.gem-hash }}"
       upload-assets: ${{ !inputs.dry_run }}
       upload-tag-name: ${{ needs.release-package.outputs.upload-tag-name }}
-      provenance-name: ${{ format('{0}_provenance.intoto.jsonl', inputs.tag_name) }}

PROVENANCE.md

@@ -0,0 +1,43 @@
+## Verifying SDK build provenance with the SLSA framework
+
+LaunchDarkly uses the [SLSA framework](https://slsa.dev/spec/v1.0/about) (Supply-chain Levels for Software Artifacts) to help developers make their supply chain more secure by ensuring the authenticity and build integrity of our published SDK packages.
+
+As part of [SLSA requirements for level 3 compliance](https://slsa.dev/spec/v1.0/requirements), LaunchDarkly publishes provenance about our SDK package builds using [GitHub's generic SLSA3 provenance generator](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md#generation-of-slsa3-provenance-for-arbitrary-projects) for distribution alongside our packages. These attestations are available for download from the GitHub release page for the release version under Assets > `multiple-provenance.intoto.jsonl`.
+
+To verify SLSA provenance attestations, we recommend using [slsa-verifier](https://github.com/slsa-framework/slsa-verifier). Example usage for verifying SDK packages is included below:
+
+<!-- x-release-please-start-version -->
+```
+# Set the version of the SDK to verify
+VERSION=0.0.0
+```
+<!-- x-release-please-end -->
+
+```
+# Download gem
+$ gem fetch launchdarkly-server-sdk-ai -v $VERSION
+
+# Download provenance from Github release
+$ curl --location -O \
+  https://github.com/launchdarkly/ruby-server-sdk-ai/releases/download/${VERSION}/launchdarkly-server-sdk-ai-${VERSION}.gem.intoto.jsonl
+
+# Run slsa-verifier to verify provenance against package artifacts 
+$ slsa-verifier verify-artifact \
+--provenance-path launchdarkly-server-sdk-ai-${VERSION}.gem.intoto.jsonl \
+--source-uri github.com/launchdarkly/ruby-server-sdk-ai \
+launchdarkly-server-sdk-ai-${VERSION}.gem
+```
+
+Below is a sample of expected output.
+TODO: Verify these are accurate
+```
+Verified signature against tlog entry index 83653185 at URL: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77a7df0bbf87a7d5fcaafa551a2101d9f993d251a56a918bb113e81d2c575dc7e25
+Verified build using builder "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.10.0" at commit 14c48a68c45871c27409591969e7f4c0ebdcdf62
+Verifying artifact launchdarkly-server-sdk-ai-1.0.0.gem: PASSED
+
+PASSED: Verified SLSA provenance
+```
+
+Alternatively, to verify the provenance manually, the SLSA framework specifies [recommendations for verifying build artifacts](https://slsa.dev/spec/v1.0/verifying-artifacts) in their documentation.
+
+**Note:** These instructions do not apply when building our libraries from source. 

Rakefile

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+require "rubocop/rake_task"
+
+RuboCop::RakeTask.new
+
+task default: %i[spec rubocop]

docs/index.md

@@ -0,0 +1,7 @@
+# LaunchDarkly Server-side AI library for Ruby
+
+This generated API documentation lists all types and methods in the SDK.
+
+The API documentation for the most recent release is hosted on [GitHub Pages](https://launchdarkly.github.io/ruby-server-sdk-ai). API documentation for current and past releases is hosted on [RubyDoc.info](https://www.rubydoc.info/gems/launchdarkly-server-sdk-ai).
+
+Source code and readme: [GitHub](https://github.com/launchdarkly/ruby-server-sdk-ai)