ci: add build provenance attestation and harden release workflows

.github/workflows/backport.yml

@@ -24,8 +24,7 @@ jobs:
 
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
           # history is needed to run git cherry-pick below
           fetch-depth: 0
 
@@ -43,17 +42,19 @@ jobs:
         id: create_pr
         env:
           NUMBER: ${{ github.event.inputs.number }}
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # not using secrets.GITHUB_TOKEN for pr create since pull requests from that token do not run workflows
+          PR_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
           title=$(gh pr view $NUMBER --json title --jq .title)
 
           branch="otelbot/backport-${NUMBER}-to-${GITHUB_REF_NAME//\//-}"
 
           git cherry-pick $commit
+          gh auth setup-git
           git push origin HEAD:$branch
-          pr_url=$(gh pr create --title "[$GITHUB_REF_NAME] $title" \
+          pr_url=$(GH_TOKEN="${PR_TOKEN}" gh pr create --title "[$GITHUB_REF_NAME] $title" \
                                 --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
                                 --head $branch \
                                 --base $GITHUB_REF_NAME)

.github/workflows/package-prepare-patch-release.yml

@@ -30,8 +30,7 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Verify prerequisites
         run: |
@@ -120,15 +119,17 @@ jobs:
 
       - name: Create pull request
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # not using secrets.GITHUB_TOKEN for pr create since pull requests from that token do not run workflows
+          PR_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           message="Prepare patch release for ${PACKAGE_NAME} v${NEXT_VERSION}"
           branch="otelbot/patch-${PACKAGE_NAME}-version-to-v${NEXT_VERSION}"
 
           git commit -a -m "$message"
+          gh auth setup-git
           git push origin HEAD:$branch
-          gh pr create --title "[$GITHUB_REF_NAME] $message" \
+          GH_TOKEN="${PR_TOKEN}" gh pr create --title "[$GITHUB_REF_NAME] $message" \
                        --body "$message." \
                        --head $branch \
                        --base $GITHUB_REF_NAME

.github/workflows/package-prepare-release.yml

@@ -100,8 +100,7 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          # zizmor: ignore[artipacked] Credentials are required by the branch pushes below.
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Set environment variables
         env:
@@ -118,7 +117,10 @@ jobs:
           echo "PACKAGE_NAME=$PACKAGE_NAME_OUTPUT" >> $GITHUB_ENV
 
       - name: Create package release branch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          gh auth setup-git
           git push origin HEAD:$RELEASE_BRANCH_NAME
 
       - name: Update package version
@@ -152,15 +154,17 @@ jobs:
 
       - name: Create pull request against the release branch
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # not using secrets.GITHUB_TOKEN for pr create since pull requests from that token do not run workflows
+          PR_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           message="Prepare release for ${PACKAGE_NAME} v${VERSION}"
           branch="otelbot/prepare-${RELEASE_BRANCH_NAME}"
 
           git commit -a -m "$message"
+          gh auth setup-git
           git push origin HEAD:$branch
-          gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
+          GH_TOKEN="${PR_TOKEN}" gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
                        --body "$message." \
                        --head $branch \
                        --base $RELEASE_BRANCH_NAME
@@ -174,8 +178,7 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Set environment variables
         env:
@@ -222,16 +225,18 @@ jobs:
 
       - name: Create pull request against main
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ steps.otelbot-token-main.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # not using secrets.GITHUB_TOKEN for pr create since pull requests from that token do not run workflows
+          PR_TOKEN: ${{ steps.otelbot-token-main.outputs.token }}
         run: |
           message="Update ${PACKAGE_NAME} version to v${NEXT_VERSION}"
           body="Update \`${PACKAGE_NAME}\` version to v\`${NEXT_VERSION}\`."
           branch="otelbot/update-${PACKAGE_NAME}-version-to-v${NEXT_VERSION}"
 
           git commit -a -m "$message"
+          gh auth setup-git
           git push origin HEAD:$branch
-          gh pr create --title "$message" \
+          GH_TOKEN="${PR_TOKEN}" gh pr create --title "$message" \
                        --body "$body" \
                        --head $branch \
                        --base main

.github/workflows/package-release.yml

@@ -25,6 +25,8 @@ jobs:
     permissions:
       contents: write # required for creating releases
       pull-requests: write # required for creating pull requests
+      id-token: write # required for generating OIDC token for attestation
+      attestations: write # required for persisting build provenance attestations
     runs-on: ubuntu-latest
     steps:
       - run: |
@@ -35,6 +37,7 @@ jobs:
 
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          ref: ${{ github.sha }}
           persist-credentials: false
 
       - name: Set environment variables
@@ -87,6 +90,7 @@ jobs:
         # back to the release branch
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
+          ref: ${{ github.sha }}
           persist-credentials: false
 
         # next few steps publish to pypi
@@ -100,6 +104,11 @@ jobs:
       - name: Build wheels
         run: ./scripts/build_a_package.sh
 
+      - name: Attest build provenance
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: "dist/*"
+
       - name: Install twine
         run: |
           uv sync --locked --only-group twine
@@ -135,17 +144,19 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release create --target $GITHUB_REF_NAME \
+          # Always tag the exact immutable commit SHA that was built, never a mutable branch ref
+          release_target=$(git rev-parse HEAD)
+          gh release create --target "$release_target" \
                             --title "${PACKAGE_NAME} ${VERSION}" \
                             --notes-file /tmp/release-notes.txt \
                             --discussion-category announcements \
-                            $RELEASE_TAG
+                            $RELEASE_TAG \
+                            dist/*
 
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: main
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Copy change log updates to main
         env:
@@ -164,8 +175,9 @@ jobs:
 
       - name: Create pull request against main
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # not using secrets.GITHUB_TOKEN for pr create since pull requests from that token do not run workflows
+          PR_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           message="Copy changelog updates from $GITHUB_REF_NAME"
           body="Copy changelog updates from \`$GITHUB_REF_NAME\`."
@@ -179,8 +191,9 @@ jobs:
           fi
 
           git commit -a -m "$message"
+          gh auth setup-git
           git push origin HEAD:$branch
-          gh pr create --title "$message" \
+          GH_TOKEN="${PR_TOKEN}" gh pr create --title "$message" \
                        --body "$body" \
                        --head $branch \
                        --base main

.github/workflows/prepare-patch-release.yml

@@ -14,8 +14,7 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
 
       - run: |
           if [[ ! $GITHUB_REF_NAME =~ ^release/v[0-9]+\.[0-9]+\.x-0\.[0-9]+bx$ ]]; then
@@ -84,15 +83,17 @@ jobs:
       - name: Create pull request
         id: create_pr
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # not using secrets.GITHUB_TOKEN for pr create since pull requests from that token do not run workflows
+          PR_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           message="Prepare release ${STABLE_VERSION}/${UNSTABLE_VERSION}"
           branch="otelbot/prepare-release-${STABLE_VERSION}-${UNSTABLE_VERSION}"
 
           git commit -a -m "$message"
+          gh auth setup-git
           git push origin HEAD:$branch
-          pr_url=$(gh pr create --title "[$GITHUB_REF_NAME] $message" \
+          pr_url=$(GH_TOKEN="${PR_TOKEN}" gh pr create --title "[$GITHUB_REF_NAME] $message" \
                        --body "$message." \
                        --head $branch \
                        --base $GITHUB_REF_NAME)
@@ -109,16 +110,16 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: main
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Use CLA approved github bot
         run: .github/scripts/use-cla-approved-github-bot.sh
 
       - name: Backport patch release changelog to main
         id: backport_pr
         env:
-          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           release_branch="otelbot/prepare-release-${STABLE_VERSION}-${UNSTABLE_VERSION}"
           message="Backport ${STABLE_VERSION}/${UNSTABLE_VERSION} changelog"
@@ -131,8 +132,9 @@ jobs:
           git checkout FETCH_HEAD -- CHANGELOG.md
           git commit -m "$message"
 
+          gh auth setup-git
           git push origin HEAD:$branch
-          pr_url=$(gh pr create --title "$message" \
+          pr_url=$(GH_TOKEN="${PR_TOKEN}" gh pr create --title "$message" \
                                 --body "$body" \
                                 --head $branch \
                                 --base main)

.github/workflows/prepare-release-branch.yml

@@ -44,11 +44,11 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          # zizmor: ignore[artipacked] Credentials are required by the branch pushes below.
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Create release branch
         env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PRERELEASE_VERSION: ${{ github.event.inputs.prerelease_version }}
         run: |
           if [[ -z $PRERELEASE_VERSION ]]; then
@@ -73,6 +73,7 @@ jobs:
             exit 1
           fi
 
+          gh auth setup-git
           git push origin HEAD:$release_branch_name
 
           echo "STABLE_VERSION=$stable_version" >> $GITHUB_ENV
@@ -109,15 +110,17 @@ jobs:
       - name: Create pull request against the release branch
         id: create_release_branch_pr
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # not using secrets.GITHUB_TOKEN for pr create since pull requests from that token do not run workflows
+          PR_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           message="Prepare release ${STABLE_VERSION}/${UNSTABLE_VERSION}"
           branch="otelbot/prepare-release-${STABLE_VERSION}-${UNSTABLE_VERSION}"
 
           git commit -a -m "$message"
+          gh auth setup-git
           git push origin HEAD:$branch
-          pr_url=$(gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
+          pr_url=$(GH_TOKEN="${PR_TOKEN}" gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
                        --body "$message." \
                        --head $branch \
                        --base $RELEASE_BRANCH_NAME)
@@ -140,8 +143,7 @@ jobs:
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Set environment variables
         env:
@@ -216,16 +218,18 @@ jobs:
       - name: Create pull request against main
         id: create_main_pr
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GITHUB_TOKEN: ${{ steps.otelbot-token-main.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # not using secrets.GITHUB_TOKEN for pr create since pull requests from that token do not run workflows
+          PR_TOKEN: ${{ steps.otelbot-token-main.outputs.token }}
         run: |
           message="Update version to ${STABLE_NEXT_VERSION}/${UNSTABLE_NEXT_VERSION}"
           body="Update version to \`${STABLE_NEXT_VERSION}/${UNSTABLE_NEXT_VERSION}\`."
           branch="otelbot/update-version-to-${STABLE_NEXT_VERSION}-${UNSTABLE_NEXT_VERSION}"
 
           git commit -a -m "$message"
+          gh auth setup-git
           git push origin HEAD:$branch
-          pr_url=$(gh pr create --title "$message" \
+          pr_url=$(GH_TOKEN="${PR_TOKEN}" gh pr create --title "$message" \
                        --body "$body" \
                        --head $branch \
                        --base main)