CI release workflow with build attestations

Move artifact production into GitHub Actions:
- .github/workflows/release.yml triggers on bare-numeric tag push
  (1.0.0, 1.0.1, ...), runs npm ci + build, attests the three release
  files via actions/attest-build-provenance, and creates the GitHub
  Release with auto-generated notes.
- Drop committed dist/ — built fresh in CI each release, no more diff
  noise from rebuilds. Manual users download assets from the latest
  release rather than checking out the repo.
- Trim versions.json to just the current version. Older entries were
  redundant (same minAppVersion floor) and re-adding history only makes
  sense if we ever raise minAppVersion for a specific release.

Bumps version to 1.0.3 to validate the workflow end-to-end.

Author: smcllns

.github/workflows/release.yml

@@ -0,0 +1,50 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
+
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            dist/html-docs/main.js
+            dist/html-docs/manifest.json
+            dist/html-docs/styles.css
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          tag="${GITHUB_REF#refs/tags/}"
+          gh release create "$tag" \
+            --title "$tag" \
+            --generate-notes \
+            dist/html-docs/main.js \
+            dist/html-docs/manifest.json \
+            dist/html-docs/styles.css

.gitignore

@@ -1,3 +1,4 @@
 node_modules/
+dist/
 *.js.map
 .DS_Store

README.md

@@ -1,6 +1,6 @@
 # HTML Docs
 
-A minimal plugin to bring the [unreasonable effectiveness of HTML](https://x.com/trq212/status/2052809885763747935) to Obsidian.
+A zero-dependency minimal plugin to bring the [unreasonable effectiveness of HTML](https://x.com/trq212/status/2052809885763747935) to Obsidian.
 
 * The HTML is rendered in a sandboxed `<iframe>`.
 * JS can run inside the HTML for interactivity, but the iframe is isolated from Obsidian and your vault.
@@ -10,17 +10,19 @@ Fork and extend if you want other features.
 
 ## Demo
 
-A minimal plugin that lets you write docs in .md or .html and open both inside Obsidian
+A minimal plugin that lets you work with .md AND .html docs inside Obsidian
 
 ![](demo.png)
 
 ## Install (manual)
 
-1. Copy the `dist/html-docs/` folder into your vault at `<vault>/.obsidian/plugins/` (so the plugin lives at `<vault>/.obsidian/plugins/html-docs/`).
+1. Download `main.js`, `manifest.json`, and `styles.css` from the [latest release](https://github.com/smcllns/obsidian-plugin-html-docs/releases/latest) and drop them into `<vault>/.obsidian/plugins/html-docs/`.
 2. Enable **HTML Docs** in Obsidian's Community Plugins settings.
 3. Turn on **Settings → Files & Links → Detect all file extensions** so `.html` files appear in the file explorer. The plugin shows a one-time notice on load if it isn't already on.
 
-To build from source instead: `npm install && npm run build` rebuilds `dist/html-docs/`.
+Releases are built and signed by GitHub Actions ([release.yml](.github/workflows/release.yml)) so the binaries carry a [build attestation](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds) you can verify against the source.
+
+To build from source instead: `npm install && npm run build` produces `dist/html-docs/` ready to copy.
 
 ## What works
 

dist/html-docs/main.js

@@ -1,7 +1,7 @@
 {
 	"id": "html-docs",
 	"name": "HTML Docs",
-	"version": "1.0.2",
+	"version": "1.0.3",
 	"minAppVersion": "1.4.0",
 	"description": "A minimal zero-dependency plugin that lets you write docs in .md or .html and open both inside your vault.",
 	"author": "smcllns",

dist/html-docs/manifest.json

@@ -1,6 +1,6 @@
 {
 	"name": "html-docs",
-	"version": "1.0.2",
+	"version": "1.0.3",
 	"description": "A minimal zero-dependency Obsidian plugin that lets you write docs in .md or .html and open both inside Obsidian.",
 	"main": "main.js",
 	"scripts": {

dist/html-docs/styles.css

@@ -1,5 +1,3 @@
 {
-	"1.0.0": "1.4.0",
-	"1.0.1": "1.4.0",
-	"1.0.2": "1.4.0"
+	"1.0.3": "1.4.0"
 }