Merge pull request #27 from rshdhere/feat/goreleaser-openssf

ci: remove version pinning and add SLSA provenance attestation

Author: vibecheck-bot

.github/workflows/release.yaml

@@ -17,23 +17,31 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
         with:
           go-version: "1.23"
 
       - name: Install Cosign
         uses: sigstore/cosign-installer@v3
 
-      - name: Set up GoReleaser
-        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a
         with:
           version: latest
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.PAT_GITHUB }}
           HOMEBREW_TOKEN: ${{ secrets.HOMEBREW_TOKEN }}
+
+      - name: Generate SLSA provenance
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: |
+            dist/*.tar.gz
+            dist/*.zip
+            dist/checksums.txt