Stamp native release provenance

.github/workflows/release.yml

@@ -49,15 +49,21 @@ jobs:
     timeout-minutes: 90
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - name: Build
+        env:
+          CELLD_BUILD_COMMIT: ${{ github.sha }}
         run: |
           set -euo pipefail
           rustup toolchain install "$RUST_VERSION" --profile minimal
           rustup default "$RUST_VERSION"
           cargo build --release --locked
           version=$(sed -n 's/^version = "\(.*\)"$/\1/p' crates/celld/Cargo.toml | head -1)
-          target/release/celld --version | grep -F "$version"
+          build_identity=$(target/release/celld --version)
+          grep -F "$version" <<< "$build_identity"
+          grep -F "$GITHUB_SHA" <<< "$build_identity"
 
       - name: Package
         run: |
@@ -86,6 +92,8 @@ jobs:
       packages: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - uses: docker/setup-buildx-action@v3
 
@@ -120,6 +128,8 @@ jobs:
       attestations: write
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
 
       - uses: actions/download-artifact@v4
         with:
@@ -209,6 +219,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
 
       - name: Resolve and validate the release tag
         run: |
@@ -261,6 +272,7 @@ jobs:
       - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
 
       - name: Resolve and validate the release tag
         run: |

crates/celld/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "celld"
-version = "0.2.1-coderabbit.1"
+version = "0.2.1-coderabbit.2"
 edition = "2021"
 rust-version = "1.94.1"
 license = "Apache-2.0"

crates/celld/main.rs

@@ -4133,7 +4133,11 @@ async fn async_main(telemetry_config: Option<celld::telemetry::Config>) -> anyho
             } else {
                 ""
             };
-            println!("celld {}{profile}", env!("CARGO_PKG_VERSION"));
+            let commit = option_env!("CELLD_BUILD_COMMIT").unwrap_or("unknown");
+            println!(
+                "celld {}{profile} (commit {commit})",
+                env!("CARGO_PKG_VERSION")
+            );
             return Ok(());
         }
         Action::Diagnose {