From 8f36be1320f87f55bf73d2da87c2f05a28f9cc2a Mon Sep 17 00:00:00 2001
From: Aarni Koskela <akx@iki.fi>
Date: Sun, 18 Oct 2026 08:52:15 +0900
Subject: [PATCH] Add actions/attest and GitHub draft release creation to
 publish workflow

---
 .github/workflows/ci.yml | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 05dbfaae8..1906a3551 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -157,14 +157,31 @@ jobs:
       name: release
       url: https://pypi.org/p/babel/
     permissions:
-      id-token: write # Required for Trusted Publishing action
+      contents: write # Required for creating the GitHub release
+      id-token: write # Required for Trusted Publishing action and attestations
+      attestations: write # Required for build provenance attestations
+      artifact-metadata: write # Required for build provenance attestations
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: dist
           path: dist/
+      - name: Generate SLSA build provenance attestations
+        id: attest
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: 'dist/*'
       - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
         with:
           verbose: true
           print-hash: true
+      - name: Create draft GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          TAG: ${{ github.ref_name }}
+          BUNDLE_PATH: ${{ steps.attest.outputs.bundle-path }}
+        run: |
+          cp "$BUNDLE_PATH" "dist/babel-${TAG#v}.intoto.jsonl"
+          gh release create "$TAG" --draft --verify-tag --title "$TAG" dist/*.whl dist/*.tar.gz dist/*.intoto.jsonl