ci: attest release artifacts

[sou1118]

Summary

• generate signed build provenance for each release archive with actions/attest
• grant the build job only the additional OIDC and attestation permissions it needs
• recommend mise installation so release asset selection and available attestations are verified automatically

Validation

• actionlint
• oxfmt --check .
• zizmor .github/workflows/
• git diff --check
• installed the latest release with mise use -g github:sou1118/typdiff in an isolated temporary environment and ran typdiff --help

[coderabbitai]

Warning

Review limit reached

@sou1118, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 25 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c4453e99-d02e-42a0-b09c-99ddf5bdf690

📥 Commits

Reviewing files that changed from the base of the PR and between a16cbe3 and 8c1b9f5.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• README.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

This PR enhances the release pipeline by generating GitHub Artifact Attestations (signed build provenance) for each produced release archive, and updates documentation to recommend an installation method that can verify those attestations when present.

Changes:

• Add minimal job-scoped permissions required for OIDC-based artifact attestation in the release build job.
• Generate build provenance attestations for each platform-specific release archive via actions/attest.
• Document installation via mise as the recommended approach, noting attestation verification support.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
README.md	Adds “mise” installation instructions and notes attestation verification.
.github/workflows/release.yml	Adds job permissions and an attestation step for built release archives.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.