From 0735c25c92ee9c87466e6953a64035428244d1a5 Mon Sep 17 00:00:00 2001
From: Jakob Borg <jakob@kastelo.net>
Date: Sat, 24 Jan 2026 09:39:01 +0100
Subject: [PATCH] build: add build attestation step at release (#10540)

Signed-off-by: Jakob Borg <jakob@kastelo.net>
---
 .github/workflows/build-syncthing.yaml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-syncthing.yaml b/.github/workflows/build-syncthing.yaml
index cf28df0ca..114e11503 100644
--- a/.github/workflows/build-syncthing.yaml
+++ b/.github/workflows/build-syncthing.yaml
@@ -818,6 +818,9 @@ jobs:
     environment: release
     permissions:
       contents: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     needs:
       - sign-for-upgrade
       - package-debian
@@ -844,10 +847,10 @@ jobs:
           name: debian-packages
           path: packages
 
-      - uses: actions/setup-go@v6
+      - name: Create GitHub build provenance attestations
+        uses: actions/attest-build-provenance@v3
         with:
-          go-version: ${{ needs.facts.outputs.go-version }}
-          cache: false
+          subject-path: packages/*
 
       - name: Push to object store (${{ env.VERSION }})
         uses: docker://docker.io/rclone/rclone:latest