ci: bind release evidence to artifact hashes

.github/workflows/ci.yml

@@ -28,6 +28,11 @@ jobs:
     if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    permissions:
+      artifact-metadata: write
+      attestations: write
+      contents: read
+      id-token: write
     env:
       BUILD_TOOLS: /tmp/obliteratus-ci-tools
 
@@ -90,7 +95,31 @@ jobs:
         run: |
           mkdir -p package-evidence
           "$BUILD_TOOLS/bin/python" -m twine check dist/* | tee package-evidence/twine-check.txt
-          sha256sum dist/* | tee package-evidence/SHA256SUMS
+
+      - name: Generate and bind CycloneDX SBOM
+        run: |
+          uv --preview-features sbom-export export \
+            --locked \
+            --format cyclonedx1.5 \
+            --all-extras \
+            --no-dev \
+            --no-editable \
+            --output-file package-evidence/obliteratus.cdx.unbound.json
+          mapfile -t wheels < <(find dist -maxdepth 1 -type f -name '*.whl' -print)
+          if [ "${#wheels[@]}" -ne 1 ]; then
+            echo "expected exactly one wheel, found ${#wheels[@]}"
+            exit 1
+          fi
+          python scripts/check_supply_chain_policy.py sbom \
+            --input package-evidence/obliteratus.cdx.unbound.json \
+            --wheel "${wheels[0]}" \
+            --output package-evidence/obliteratus.cdx.json
+          rm package-evidence/obliteratus.cdx.unbound.json
+
+      - name: Generate canonical release checksums
+        run: >-
+          sha256sum dist/* package-evidence/obliteratus.cdx.json |
+          tee package-evidence/SHA256SUMS
 
       - name: Verify installed wheel contract
         run: |
@@ -154,6 +183,27 @@ jobs:
           "$sdist_env/bin/python" -I -m obliteratus --help > "$GITHUB_WORKSPACE/package-evidence/sdist-module-help.txt"
           "$sdist_env/bin/obliteratus" --help > "$GITHUB_WORKSPACE/package-evidence/sdist-console-help.txt"
 
+      - name: Attest release-set SLSA provenance
+        id: provenance
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-checksums: package-evidence/SHA256SUMS
+
+      - name: Attest wheel SBOM
+        id: sbom-attestation
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: dist/*.whl
+          sbom-path: package-evidence/obliteratus.cdx.json
+
+      - name: Retain Sigstore attestation bundles
+        run: |
+          cp "${{ steps.provenance.outputs.bundle-path }}" \
+            package-evidence/slsa-provenance.sigstore.json
+          cp "${{ steps.sbom-attestation.outputs.bundle-path }}" \
+            package-evidence/sbom-attestation.sigstore.json
+          sha256sum -c package-evidence/SHA256SUMS
+
       - name: Upload distributions and package evidence
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -706,6 +756,7 @@ jobs:
   supply-chain:
     name: Supply chain
     if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/v')
+    needs: package
     runs-on: ubuntu-latest
     timeout-minutes: 30
     env:
@@ -719,6 +770,12 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Download attested release set
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: distributions-py3.12
+          path: /tmp/supply-chain-evidence/release
+
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
@@ -784,27 +841,19 @@ jobs:
             echo "$status" > "$EVIDENCE/uv-audit-py${version}.status"
           done
 
-      - name: Build wheel and bind CycloneDX SBOM
+      - name: Verify attested release set and bound CycloneDX SBOM
         run: |
-          mkdir -p "$EVIDENCE/dist"
-          "$SUPPLY_TOOLS/bin/python" -m build --wheel --outdir "$EVIDENCE/dist"
-          uv --preview-features sbom-export export \
-            --locked \
-            --format cyclonedx1.5 \
-            --all-extras \
-            --no-dev \
-            --no-editable \
-            --output-file "$EVIDENCE/obliteratus.cdx.unbound.json"
-          mapfile -t wheels < <(find "$EVIDENCE/dist" -maxdepth 1 -type f -name '*.whl' -print)
+          cd "$EVIDENCE/release"
+          sha256sum -c package-evidence/SHA256SUMS
+          mapfile -t wheels < <(find dist -maxdepth 1 -type f -name '*.whl' -print)
           if [ "${#wheels[@]}" -ne 1 ]; then
             echo "expected exactly one wheel, found ${#wheels[@]}"
             exit 1
           fi
-          python scripts/check_supply_chain_policy.py sbom \
-            --input "$EVIDENCE/obliteratus.cdx.unbound.json" \
+          python "$GITHUB_WORKSPACE/scripts/check_supply_chain_policy.py" sbom \
+            --input package-evidence/obliteratus.cdx.json \
             --wheel "${wheels[0]}" \
-            --output "$EVIDENCE/obliteratus.cdx.json"
-          sha256sum "${wheels[0]}" > "$EVIDENCE/distribution.SHA256SUM"
+            --output "$EVIDENCE/verified-obliteratus.cdx.json"
 
       - name: Collect packaged-dependency license inventory
         run: >-