Take tui-kit v0.2.8: hashed pip install, provenance bundle on the release (#8)

Author: edimarlnx

.github/workflows/ci.yml

@@ -142,11 +142,14 @@ jobs:
 
       - name: package metadata matches the manifest
         run: |
-          # Pinned: check-nfpm.py reads .goreleaser.yaml, so the parser it
-          # uses is part of the check. Bump it here by hand.
-          python3 -m pip install --quiet --disable-pip-version-check pyyaml==6.0.3
           go mod download github.com/tui-tools/tui-kit
           kit=$(go list -m -f '{{.Dir}}' github.com/tui-tools/tui-kit)
+          # check-nfpm.py reads .goreleaser.yaml, so the parser it uses is
+          # part of the check. The kit pins it by version and by the hash of
+          # every wheel of that version (tools/requirements.txt), and pip
+          # refuses anything that does not match.
+          python3 -m pip install --quiet --disable-pip-version-check \
+            --require-hashes -r "$kit/tools/requirements.txt"
           python3 "$kit/tools/check-nfpm.py" --manifest tool.json \
             --config .goreleaser.yaml
 
@@ -257,6 +260,7 @@ jobs:
       # produced each file. `gh attestation verify <file> -R tui-tools/tui-firewall`
       # checks a download against it without any key to distribute.
       - name: attest build provenance
+        id: attest
         uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
@@ -265,3 +269,14 @@ jobs:
             dist/*.rpm
             dist/*.pkg.tar.zst
             dist/checksums.txt
+
+      # The attestation lives in GitHub's store, which `gh attestation verify`
+      # reads; Scorecard's Signed-Releases check reads the release's assets
+      # instead, and looks for a `*.intoto.jsonl`. The same bundle, attached
+      # under that name, satisfies both readers.
+      - name: attach the provenance bundle to the release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          cp "${{ steps.attest.outputs.bundle-path }}" dist/provenance.intoto.jsonl
+          gh release upload "$GITHUB_REF_NAME" dist/provenance.intoto.jsonl --clobber

go.mod

@@ -6,7 +6,7 @@ require (
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/tui-tools/tui-kit v0.2.5
+	github.com/tui-tools/tui-kit v0.2.8
 )
 
 require (

go.sum

@@ -38,8 +38,8 @@ github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
-github.com/tui-tools/tui-kit v0.2.5 h1:zsqk3LVoDgp7FLEHK3opjiCAQ4ou0bvzl689kr7Tn9s=
-github.com/tui-tools/tui-kit v0.2.5/go.mod h1:Vpg1NcQ5ktylMvXTzsixdHjLUNxhntR3ZYSOYaQ7/FQ=
+github.com/tui-tools/tui-kit v0.2.8 h1:tfrMSjWVjJsbGum884kXQB2N1OUqf6L6Dnoj9Wgu9TE=
+github.com/tui-tools/tui-kit v0.2.8/go.mod h1:Vpg1NcQ5ktylMvXTzsixdHjLUNxhntR3ZYSOYaQ7/FQ=
 github.com/xo/terminfo v1.0.0 h1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY=
 github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=