Nix Forge CI v2.8.0

Changelog

  • Publish each release's Sigstore bundle as a portable .intoto.jsonl asset beside the archive, checksum, and manifest.
  • Verify release subjects against that exact bundle before publication and require the portable provenance in the shared release contract.

This compatible v2 release adds no pull request or merge queue jobs. Provenance export runs only for tagged releases and uses the bundle already produced by actions/attest, so it does not add a second attestation or network lookup. Existing callers need no migration until they choose to adopt this release.

The reviewed implementation is commit 2705c51e254ef3f43e90da1ab8fc717a54991487 (PR #46). The nix-forge/ci/.github/workflows/release.yml workflow builds, attests, verifies, and publishes the tagged source archive and portable provenance.

Validation: nix develop --command bash scripts/check.sh, nix flake check on x86_64 Linux, and a Codex Security diff scan passed with no reportable findings. PR and merge-group CI, CodeQL, and DCO must pass before tagging.

The v2.7.0 pin remains usable for rollback. No support end date is scheduled for v2.7.x; a later major contract change will define its end-of-life window.