fix(security): add artifact attestation for signed releases by WilliamBerryiii · Pull Request #257 · microsoft/hve-core

WilliamBerryiii · 2026-01-23T18:24:58Z

Description

Add GitHub Artifact Attestations to the release workflow, enabling cryptographic signing of VSIX release artifacts using Sigstore. This satisfies the OSSF Best Practices signed_releases criterion by establishing verifiable build provenance.

Added attest-and-upload job to main.yml that downloads the VSIX artifact, attests it with Sigstore, and uploads it to the GitHub Release
Configured OIDC permissions (id-token: write, attestations: write, contents: write) for Sigstore integration
Documented verification process in SECURITY.md with GitHub CLI commands

Related Issue(s)

Related to OSSF Silver badge requirements for signed releases.

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)

Note for AI Artifact Contributors:

Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.

Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.

See Agents Not Accepted and Model Version Requirements.

Other:

Script/automation (.ps1, .sh, .py)
Other (please describe):

Sample Prompts (for AI Artifact Contributions)

N/A - This PR does not include AI artifact contributions.

Testing

Validated workflow YAML syntax
Verified action SHA pinning follows repository conventions
Ran npm run lint:md and npm run lint:frontmatter (passed)

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)

AI Artifact Contributions

N/A

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

Additional Notes

The attest-and-upload job runs only when release_created == 'true', ensuring attestation occurs only for actual releases. Actions use SHA pinning per repository conventions:

actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 (v4.1.8)
actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 (v2.2.3)

🔒 - Generated by Copilot

github-actions · 2026-01-23T18:25:15Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

actions/actions/attest-build-provenance

c074443f1aee8d4aeeae555aebba3282517141b2

Unknown

actions/actions/download-artifact

37930b1c2abaa49bbe596cd826c3c89aef350131

🟢 6.4

Details

Check	Score	Reason
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Code-Review	🟢 10	all changesets reviewed
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Maintained	🟢 10	24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Pinned-Dependencies	⚠️ 1	dependency not pinned by hash detected -- score normalized to 1
Security-Policy	🟢 9	security policy file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Vulnerabilities	🟢 9	1 existing vulnerabilities detected
SAST	🟢 9	SAST tool detected but not run on all commits

Scanned Files

.github/workflows/main.yml

codecov-commenter · 2026-01-23T18:26:58Z

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 28.81%. Comparing base (ae76cab) to head (1d20e68).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
scripts/security/Update-ActionSHAPinning.ps1	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #257      +/-   ##
==========================================
+ Coverage   28.80%   28.81%   +0.01%     
==========================================
  Files          14       14              
  Lines        2736     2738       +2     
==========================================
+ Hits          788      789       +1     
- Misses       1948     1949       +1

Flag	Coverage Δ
pester	`28.81% <0.00%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
scripts/security/Update-ActionSHAPinning.ps1	`0.00% <0.00%> (ø)`

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

This PR adds GitHub Artifact Attestations to the release workflow, implementing cryptographic signing of VSIX release artifacts using Sigstore to meet OSSF Best Practices requirements for signed releases. The changes enable verifiable build provenance for all GitHub Release artifacts.

Changes:

Added new attest-and-upload job to the main workflow that downloads, attests, and uploads VSIX artifacts to GitHub Releases
Documented the verification process in SECURITY.md with step-by-step instructions for users to verify release integrity using the GitHub CLI
Configured necessary OIDC permissions (id-token: write, attestations: write, contents: write) for Sigstore integration

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
`.github/workflows/main.yml`	Adds the `attest-and-upload` job with artifact download, Sigstore attestation, and GitHub Release upload steps
`SECURITY.md`	Documents verification steps for release integrity checking and provides a comparison table of signed artifacts across distribution channels

.github/workflows/main.yml

SECURITY.md

.github/workflows/main.yml

SECURITY.md

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

SECURITY.md

.github/workflows/main.yml

- add attest-and-upload job to main.yml workflow - configure Sigstore permissions for OIDC token - document verification process in SECURITY.md 🔒 - Generated by Copilot

- restructure extension-package-release job to run only when release_created is true - pass correct version from release-please outputs to packaging workflow - update workflow documentation and mermaid diagram - fix SECURITY.md table alignment per review feedback 📦 - Generated by Copilot

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

.github/workflows/main.yml

scripts/security/Update-ActionSHAPinning.ps1

- update attest-and-upload job to use download-artifact@v7.0.0 - add download-artifact@v7 entry to SHA pinning map 🔧 - Generated by Copilot

🤖 I have created a release *beep* *boop* --- ## [2.0.0](hve-core-v1.1.0...hve-core-v2.0.0) (2026-01-28) ### ⚠ BREAKING CHANGES * **agents:** add Task Reviewer and expand RPI to 4-phase workflow ([#277](#277)) ### ✨ Features * **agents:** add hve-core-installer agent to extension package ([#297](#297)) ([c0e48c6](c0e48c6)) * **agents:** add Task Reviewer and expand RPI to 4-phase workflow ([#277](#277)) ([ae76cab](ae76cab)) * **build:** add code coverage reporting to Pester workflow ([#230](#230)) ([a34822a](a34822a)) * **docs:** add GOVERNANCE.md for OSSF Silver Badge compliance ([#235](#235)) ([b0e752c](b0e752c)) * **docs:** add ROADMAP.md for OSSF Silver badge compliance ([#238](#238)) ([4a41c16](4a41c16)) * **mcp:** add MCP server configuration guidance and installer enhancements ([#225](#225)) ([0bce418](0bce418)) * **scripts:** add YAML linting with actionlint ([#234](#234)) ([d9301f9](d9301f9)) * **security:** add OpenSSF Scorecard workflow and badge ([#271](#271)) ([7c6d788](7c6d788)) * **skills:** add video-to-gif conversion skill with FFmpeg two-pass optimization ([#247](#247)) ([8d65c42](8d65c42)) * **tests:** add Pester tests for LintingHelpers and Validate-MarkdownFrontmatter ([#197](#197), [#198](#198)) ([#205](#205)) ([51ae563](51ae563)) ### 🐛 Bug Fixes * **build:** detect table formatting changes via git diff ([#261](#261)) ([985eee0](985eee0)) * **build:** disable MD024 lint rule in CHANGELOG for release-please ([#220](#220)) ([971df94](971df94)) * **build:** quote shell variables and group redirects in workflow files ([#299](#299)) ([3372509](3372509)) * **build:** resolve scorecard badge and workflow security issues ([#301](#301)) ([aeaed13](aeaed13)) * **extension:** remove frontmatter from README and exclude from markdown linting ([#223](#223)) ([4272529](4272529)) * **instructions:** quote applyTo glob pattern for YAML compatibility ([#216](#216)) ([085199c](085199c)) * **scripts:** add FooterExcludePaths parameter to frontmatter validation ([#334](#334)) ([64db98d](64db98d)) * **scripts:** add GHSA word and logs/ exclusion to cspell config ([#214](#214)) ([5c99b3f](5c99b3f)) * **scripts:** correct type assertions in Invoke-YamlLint.Tests.ps1 ([#332](#332)) ([af7050d](af7050d)) * **scripts:** eliminate false positives in dependency pinning npm pattern ([#273](#273)) ([ccbdfa3](ccbdfa3)) * **security:** add artifact attestation for signed releases ([#257](#257)) ([c52d6e2](c52d6e2)) * standardize markdown footers and complete frontmatter ([#217](#217)) ([b4e7556](b4e7556)) ### 📚 Documentation * add OpenSSF Best Practices Passing badge to README ([#239](#239)) ([91bc529](91bc529)) * **architecture:** add architecture documentation and value proposition ([#252](#252)) ([0e4b02f](0e4b02f)) * **contributing:** add testing requirements for OSSF compliance ([#254](#254)) ([4db1a18](4db1a18)) * **docs:** add enterprise status badges to README header ([#270](#270)) ([ccb68a4](ccb68a4)) * **security:** add security assurance case and threat model for OSSF Silver ([#259](#259)) ([a390e26](a390e26)) ### ♻️ Refactoring * **application:** wrap execution with try blocks, ensure proper … ([#296](#296)) ([35c4417](35c4417)) * **scripts:** extract frontmatter validation to testable module ([#293](#293)) ([4e8707e](4e8707e)) * **scripts:** extract pure functions for Pester testability ([#221](#221)) ([d40e742](d40e742)) ### 🔧 Maintenance * **deps-dev:** bump cspell from 9.4.0 to 9.6.0 in the npm-dependencies group ([#208](#208)) ([855914b](855914b)) * **deps-dev:** bump cspell from 9.6.0 to 9.6.1 in the npm-dependencies group ([#294](#294)) ([1e45ad6](1e45ad6)) * **deps:** bump actions/setup-node from 6.1.0 to 6.2.0 in the github-actions group ([#209](#209)) ([c4c69e2](c4c69e2)) * **deps:** bump the github-actions group with 4 updates ([#295](#295)) ([d8337b8](d8337b8)) * remove step-security/harden-runner from workflows ([#246](#246)) ([c5708d8](c5708d8)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com>

WilliamBerryiii requested a review from a team as a code owner January 23, 2026 18:24

Copilot AI review requested due to automatic review settings January 23, 2026 18:24

Copilot started reviewing on behalf of WilliamBerryiii January 23, 2026 18:25 View session

Copilot AI reviewed Jan 23, 2026

View reviewed changes

.github/workflows/main.yml Show resolved Hide resolved

.github/workflows/main.yml Show resolved Hide resolved

SECURITY.md Outdated Show resolved Hide resolved

.github/workflows/main.yml Outdated Show resolved Hide resolved

SECURITY.md Show resolved Hide resolved

WilliamBerryiii force-pushed the fix/signed-releases branch from ca259ff to 1f47ab9 Compare January 23, 2026 18:39

Copilot AI review requested due to automatic review settings January 24, 2026 00:21

Copilot started reviewing on behalf of WilliamBerryiii January 24, 2026 00:22 View session

Copilot AI reviewed Jan 24, 2026

View reviewed changes

SECURITY.md Outdated Show resolved Hide resolved

.github/workflows/main.yml Show resolved Hide resolved

agreaves-ms approved these changes Jan 24, 2026

View reviewed changes

WilliamBerryiii added 2 commits January 24, 2026 15:51

fix(security): add artifact attestation for signed releases

dcab8b5

- add attest-and-upload job to main.yml workflow - configure Sigstore permissions for OIDC token - document verification process in SECURITY.md 🔒 - Generated by Copilot

WilliamBerryiii force-pushed the fix/signed-releases branch from 12fb64b to 63f61f2 Compare January 25, 2026 00:10

Copilot AI review requested due to automatic review settings January 25, 2026 00:10

Copilot started reviewing on behalf of WilliamBerryiii January 25, 2026 00:10 View session

Copilot AI reviewed Jan 25, 2026

View reviewed changes

.github/workflows/main.yml Outdated Show resolved Hide resolved

scripts/security/Update-ActionSHAPinning.ps1 Show resolved Hide resolved

WilliamBerryiii added 2 commits January 24, 2026 16:16

fix: correct table separator spacing in SECURITY.md

fed18f4

fix(build): update download-artifact to v7.0.0 for consistency

1d20e68

- update attest-and-upload job to use download-artifact@v7.0.0 - add download-artifact@v7 entry to SHA pinning map 🔧 - Generated by Copilot

WilliamBerryiii merged commit c52d6e2 into main Jan 25, 2026
16 checks passed

WilliamBerryiii deleted the fix/signed-releases branch January 25, 2026 00:28

hve-core-release-please bot mentioned this pull request Jan 25, 2026

chore(main): release hve-core 2.0.0 #212

Merged

WilliamBerryiii mentioned this pull request Jan 26, 2026

Configure cryptographically signed releases for OSSF Silver badge compliance #243

Closed

13 tasks

This was referenced Jan 28, 2026

chore(main): release hve-core 3.0.0 #341

Closed

chore(main): release hve-core 3.0.0 #417

Closed

This was referenced Feb 6, 2026

chore(main): release hve-core 3.0.0 #441

Closed

chore(main): release hve-core 3.0.0 #530

Closed

chore(main): release hve-core 3.0.0 #532

Closed

chore(main): release hve-core 3.0.0 #534

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(security): add artifact attestation for signed releases#257

fix(security): add artifact attestation for signed releases#257
WilliamBerryiii merged 4 commits intomainfrom
fix/signed-releases

WilliamBerryiii commented Jan 23, 2026

Uh oh!

github-actions bot commented Jan 23, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Jan 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

WilliamBerryiii commented Jan 23, 2026

Description

Related Issue(s)

Type of Change

Sample Prompts (for AI Artifact Contributions)

Testing

Checklist

Required Checks

AI Artifact Contributions

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

github-actions bot commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

codecov-commenter commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Jan 23, 2026 •

edited

Loading

codecov-commenter commented Jan 23, 2026 •

edited

Loading