Create release workflow with hashes and provenance

[thatsjet]

Summary

Create a GitHub Actions workflow that triggers on version tag push, builds all artifacts, generates SHA-256 checksums, signs with GitHub Artifact Attestations, and publishes to all 4 registries.

Prerequisites

• Issue Add test suites for all 4 languages #8 (test suites) completed
• Issue Set up GitHub Actions CI workflow for all 4 languages #14 (CI workflow) completed
• Issue Set up package publishing for PyPI, npm, Maven Central, and Go #15 (package publishing setup) completed
• Registry secrets configured in GitHub repo settings

Instructions

Create .github/workflows/release.yml

Workflow structure:

Trigger: push tag matching v*.*.*

Job 1: validate
  - Checkout code
  - Read version from security_events.yaml
  - Verify tag matches YAML version
  - Fail fast if mismatch

Job 2: test (needs: validate)
  - Run full test suite for all 4 languages (reuse CI matrix)

Job 3: build-python (needs: test)
  - Copy security_events.yaml into python/
  - Build sdist + wheel: python -m build
  - Upload artifacts

Job 4: build-nodejs (needs: test)
  - Copy security_events.yaml + LICENSE into nodejs/
  - npm pack
  - Upload artifacts

Job 5: build-java (needs: test)
  - Copy security_events.yaml into java/src/main/resources/
  - mvn package -DskipTests (already tested)
  - Upload artifacts

Job 6: checksums (needs: build-python, build-nodejs, build-java)
  - Download all artifacts
  - Generate SHA256SUMS.txt: sha256sum *.tar.gz *.whl *.tgz *.jar > SHA256SUMS.txt
  - Sign with GitHub Artifact Attestations (actions/attest v4)
  - Upload SHA256SUMS.txt as artifact

Job 7: release (needs: checksums)
  - Create GitHub Release from tag
  - Attach all artifacts + SHA256SUMS.txt
  - Auto-generate release notes from commits

Job 8: publish-pypi (needs: release)
  - Download Python artifacts
  - twine upload (using PYPI_API_TOKEN)
  - Or use PyPI Trusted Publishers (OIDC, preferred)

Job 9: publish-npm (needs: release)
  - Download Node.js artifacts
  - npm publish --provenance (enables npm provenance)

Job 10: publish-maven (needs: release)
  - Download Java artifacts
  - mvn deploy with GPG signing

(Go auto-publishes via proxy.golang.org when tag is pushed)

Provenance (Tier 1 — do now)

Add actions/attest@v4 after building each artifact:

permissions:
  id-token: write
  contents: read
  attestations: write

- uses: actions/attest@v4
  with:
    subject-path: 'dist/*'

This gives Sigstore-backed provenance for free on public repos.

Versioning

• Single version across all languages, sourced from security_events.yaml version field
• Git tags: v1.0.0 (primary tag) + golang/v1.0.0 (Go multi-module convention)
• All package versions must match the tag

Verification

• Push a test tag (e.g., v1.0.0-rc.1) and verify the workflow runs
• SHA256SUMS.txt is attached to the GitHub Release
• Artifacts appear on PyPI, npm, Maven Central after publishing
• gh attestation verify <artifact> succeeds