From b27fc56bab0e7aab0274a74c16dc531001927c2a Mon Sep 17 00:00:00 2001
From: forkless <forkless@users.noreply.github.com>
Date: Sat, 13 Jun 2026 19:50:48 +0200
Subject: [PATCH] add slsa-verifier step to release workflow for build
 verification

---
 .github/workflows/release.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5d167cc..59c49e5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -111,6 +111,16 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           path: builds/
+      - name: Verify SLSA provenance
+        run: |
+          for file in builds/*/*.tar.gz builds/*/*.zip builds/*/*.cdx.json; do
+            [ -f "$file" ] || continue
+            slsa-verifier verify-artifact \
+              --provenance-path builds/*/*.intoto.jsonl \
+              --source-uri github.com/forkless/NotAlterra \
+              --source-tag "${{ github.ref_name }}" \
+              "$file"
+          done
       - name: Create draft release
         uses: softprops/action-gh-release@v2
         with: