ci: attest BCR source archive - #662

Summary

Publish provenance for the exact RE2 source ZIP referenced by Bazel Central Registry.

RE2 already signs its release archives with Sigstore. This change additionally generates GitHub/SLSA build provenance for the release ZIP and publishes the bundle alongside the existing release assets as re2-${tag}.zip.intoto.jsonl.

Archive identity

RE2's BCR source template resolves to:

https://github.com/{OWNER}/{REPO}/releases/download/{TAG}/{REPO}-{TAG}.zip

For the live 2025-11-05 entry, BCR references:

https://github.com/google/re2/releases/download/2025-11-05/re2-2025-11-05.zip

Its BCR integrity value decodes to:

sha256:c7b1a7a7c68d2d7cf8d343dc56655c1b5a8c8aadedc017db453d4c1d8913b844

That matches the SHA-256 of the published release ZIP.

The provenance subject is that same re2-${tag}.zip file. The identity link to BCR therefore comes from BCR's source URL and digest selecting the same archive bytes; the attestation itself does not assert that BCR consumed or accepted the artifact.

Change

The release workflow now:

1. keeps the existing Sigstore signing;
2. generates build provenance with the release ZIP as the subject;
3. writes the bundle explicitly as compact JSONL;
4. publishes it with the release assets.

The existing BCR publisher remains at attest: false.

BCR currently verifies source-archive provenance against the bazel-contrib release_ruleset builder identity. RE2 keeps its existing release workflow here, so this PR does not claim to enable BCR attestations.json verification. That would require adopting the supported release builder or a future BCR verifier-policy change.

No RE2 source, library, archive contents, or BCR source URL changes.

Validation

• current release ZIP SHA-256 matches the live BCR source.json integrity value
• provenance subject is the exact release ZIP filename referenced by the BCR source template
• provenance bundle is serialized explicitly as JSONL
• GitHub Actions references touched in release.yml are pinned to full commit SHAs
• git diff --check: PASS