We want to change to attesting artifacts with the tag associated with the release rather than the current head of main where release assets are actually built. We need to figure out a strategy for doing this while remaining compatible with previous versions with provenance checks that are expecting the ref attestation to be against main/head. Perhaps we attest in both places for a while to allow older versions to successfully update to a newer version that only verifies against the tag?
Related #87, #155
We want to change to attesting artifacts with the tag associated with the release rather than the current head of main where release assets are actually built. We need to figure out a strategy for doing this while remaining compatible with previous versions with provenance checks that are expecting the ref attestation to be against
main/head. Perhaps we attest in both places for a while to allow older versions to successfully update to a newer version that only verifies against the tag?Related #87, #155