#5149·syft

Adding GitHub attestations

Author: igor-makarovCreated Aug 3, 2026Updated Sep 9, 2026
Labelsenhancementrelease

What would you like to be added:

GitHub attestations using actions/attest

Why is this needed:

Tool installers, such as Mise, check GH attestations automatically before trusting a release checksum.

Additional context:

It is an additive change that does not introduce risk. It's very simple to add to an existing GH release workflow.

P.S. Thank you!