[SoulPancake]

Closes #773

Replaces slsa-github-generator with GitHub artifact attestations (actions/attest).

• goreleaser builds and uploads to the draft release, now without persisted git credentials or the Go cache.
• attest attests every file in checksums.txt and the Docker image, pushes the image attestation to Docker Hub, and attaches the bundle as fga.intoto.jsonl.
• verify-binary-provenance and verify-image-provenance check the attestation store, the attached bundle and the Docker Hub copy, with the signer pinned to main.yaml at the release tag.
• undraft-release runs only after both pass.
• In .goreleaser.yaml, prereleases no longer move the latest, vX and vX.Y Docker tags or update the Homebrew formulas.

Verification change

fga.intoto.jsonl keeps its name for Scorecard, but is now a Sigstore bundle signed by main.yaml. For new releases, slsa-verifier and cosign verify-attestation with the slsa-github-generator identity no longer work. Use:

# binaries
gh attestation verify fga_<version>_linux_amd64.tar.gz --repo openfga/cli

# binaries, with the release asset
gh attestation verify fga_<version>_linux_amd64.tar.gz --repo openfga/cli --bundle fga.intoto.jsonl

# image
gh attestation verify oci://docker.io/openfga/cli@<digest> --repo openfga/cli

The next release PR will add this note to the CHANGELOG.

[Copilot]

🟢 Approval recommended

The attestation configuration, verification constraints, and release dependencies are consistent, with no unresolved findings.

No open issues 🎉

What changed in this PR

Migrates release provenance from the SLSA generator to GitHub artifact attestations.

Changes:

• Attests release artifacts and Docker images within the release job.
• Retains fga.intoto.jsonl for Scorecard compatibility.
• Replaces verification tools with gh attestation verify, constrained to the workflow identity and source ref.

File	Description
.github/​workflows/​main.yaml	Updates attestation generation, permissions, release dependencies, and verification.

_{Review effort: Balanced}

[Siddhant-K-code]

Reviewed the workflow change, the actions/attest v4.2.2 source, and GoReleaser's upload behavior.

What checks out

• The actions/attest SHA matches the v4.2.2 tag.
• checksums.txt lists the archives, SBOMs and Linux packages, so the binary attestation covers what we ship.
• docker.io/openfga/cli is the form the action docs ask for, and the action maps it to the right Docker Hub host and login.
• Scorecard only looks at the .intoto.jsonl file name, so keeping that name keeps the score.

What needs work (in priority order)

1. Nothing in CI checks the image attestation that gets pushed to Docker Hub. Please add the --bundle-from-oci check.
2. The fga.intoto.jsonl we ship is no longer verified in CI. The old job checked it. Please bring that check back.
3. A failure in any new attest step now breaks goreleaser re-runs. Consider a separate attest job.
4. fga.intoto.jsonl keeps its name but changes format. People using slsa-verifier or the old cosign command will break. Please call this out in the release notes.

Smaller items are inline.

Also: the --cert-identity value looks correct to me, but it will only get its first real check on the first release. That is one more reason to let verification block the undraft (see the inline note on undraft-release).

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 91998676-c1b8-4b70-9696-f9b7c067d419

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0a100361-260e-4200-8c54-d41482fe1127

📥 Commits

Reviewing files that changed from the base of the PR and between ce694a8 and 8fa07c5.

📒 Files selected for processing: 1

• .github/workflows/main.yaml

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

Walkthrough

The release workflow replaces SLSA provenance generation and verification with GitHub artifact attestations. It attests release artifacts and the Docker image, uploads an attestation bundle to the draft release, and verifies the artifacts and image.

Changes

Release attestations

Layer / File(s)	Summary
Create release attestations .github/workflows/main.yaml	The goreleaser job gains attestation permissions. The workflow removes binary hash and SLSA subject-file generation, attests release artifacts and the Docker image, and uploads the attestation bundle as fga.intoto.jsonl.
Release and image verification .github/workflows/main.yaml	The workflow replaces SLSA and Cosign verification with GitHub attestation verification for release archives, SBOMs, and the Docker image. It also updates the undraft-release job dependencies.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Refactor

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant GitHubAttestationService
  participant GitHubRelease
  participant DockerRegistry
  participant VerificationJobs
  ReleaseWorkflow->>GitHubAttestationService: Attest release artifacts from dist/checksums.txt
  GitHubAttestationService-->>ReleaseWorkflow: Return attestation bundle
  ReleaseWorkflow->>GitHubRelease: Upload fga.intoto.jsonl
  ReleaseWorkflow->>GitHubAttestationService: Attest published image digest
  VerificationJobs->>GitHubAttestationService: Verify release artifact attestations
  VerificationJobs->>GitHubAttestationService: Verify image attestation for digest and workflow identity

Loading

Suggested reviewers: siddhant-k-code

Merge Risk: 🟡 Moderate · up to 8fa07

If attestation fails after the draft assets are uploaded, a normal failed-job rerun may fail on those existing assets. Address the release-recovery path before merging.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: replacing the SLSA generator with GitHub artifact attestations in CI.
Linked Issues check		Issue #773 is active and its coding requirements are implemented in .github/workflows/main.yaml. The goreleaser job grants attestations: write and id-token: write, attests dist/checksums.txt…
Out of Scope Changes check		The pull request changes only .github/workflows/main.yaml. The changes remove the deprecated SLSA workflow, add artifact and image attestations, preserve the Scorecard release asset, and update veri…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

Issue #773 is active and its coding requirements are implemented in .github/workflows/main.yaml. The goreleaser job grants attestations: write and id-token: write, attests dist/checksums.txt, attests the Docker image with push-to-registry: true, and retains fga.intoto.jsonl as a release asset. The SLSA subject generation and provenance jobs are removed. Release undrafting and verification use the new attestation flow. Binary and image verification use gh attestation verify with the main.yaml certificate identity. README.md contains no SLSA or fga.intoto.jsonl documentation that requires an update.

Full details: Out of Scope Changes check

Explanation

The pull request changes only .github/workflows/main.yaml. The changes remove the deprecated SLSA workflow, add artifact and image attestations, preserve the Scorecard release asset, and update verification. These changes directly support issue #773. No unrelated implementation or documentation changes are present.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches: 💡 1

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Siddhant-K-code]

All 7 review items are addressed. Two things to check before cutting the beta to test this:

1. Sync develop with main first.

Betas are tagged on develop (release-please-develop.yml), and a tag runs the main.yaml from the tagged commit. develop is 40 commits behind main right now, so a beta cut today would still run the old SLSA flow. Merge this PR, bring develop up to date with main, then cut the beta.

2. A beta still publishes to Docker Hub and Homebrew, even if it stays a draft.

GoReleaser runs before undraft-release, so these happen no matter what the verify jobs do:

• Docker Hub: latest, v0 and v0.<minor> move to the beta image.
• Homebrew: the stable fga formula is updated to the beta. Its download links point at the draft release, so brew install fga fails until the release is published.

Suggested fix in .goreleaser.yaml, here or in a small PR before the beta:

dockers_v2:
  - tags:
      - "{{ .Tag }}"
      - '{{ if not .Prerelease }}latest{{ end }}'
      - '{{ if not .Prerelease }}v{{ .Major }}{{ end }}'
      - '{{ if not .Prerelease }}v{{ .Major }}.{{ .Minor }}{{ end }}'
    # other fields unchanged

brews:
  - name: "{{.ProjectName}}"
    skip_upload: auto
    # other fields unchanged
  - name: "{{.ProjectName}}@{{.Version}}"
    skip_upload: auto
    # other fields unchanged

dockers_v2 drops tags that render empty, and skip_upload: auto skips the tap update when the tag has a prerelease suffix. The {{ .Tag }} image used by the Image digest step is not affected.

[SoulPancake]

No so betas can be released from either of them ( main too ) and that is the norm too, we would only use develop when we might have something to release in main while we have something else or larger to release in beta without worrying about those.

[SoulPancake]

A beta still publishes to Docker Hub and Homebrew, even if it stays a draft

Yes that is the intention!

[Siddhant-K-code]

Checked the prerelease change. Betas now push only their own Docker tag and skip both Homebrew formulas. Stable releases are unchanged. LGTM.

[Copilot]

🟡 Changes recommended

The signing job trusts mutable release checksums, allowing substituted artifacts to receive valid provenance.

1 open issue

• Verify checksum manifest from immutable build output · New

_{Review effort: Balanced}

[Siddhant-K-code]

Checked the checksums.txt pinning. attest now fails if the draft copy differs from the build output, including when the digest is empty or the file is missing. GoReleaser does not rewrite checksums.txt after uploading it, so normal releases will pass this check. LGTM.