[ryanduguid]

What this changes

Adds a manual Attest release workflow. It signs build provenance for the tagged ozzit.xlsx and adds the bundle, ozzit-X.Y.Z.intoto.jsonl, to the draft release before it is published. RELEASING.md places the step.

gh workflow run attest-release.yml --ref vX.Y.Z
  checks   required_checks.py: verify.yml verify-gates succeeded on main for the tag commit
  attest   tag is a verified, signed, annotated vX.Y.Z on this commit
           exactly one draft release holding SHA256SUMS, ozzit.xlsx and provenance.json, digests checked
           prepare_release_bundle.py verify + the draft workbook equals git show <tag>:ozzit.xlsx
           actions/attest on the tagged workbook, then gh attestation verify (API and bundle)
           upload to the verified release ID only if the draft, its assets and the tag are unchanged

Why

OpenSSF Scorecard scores Ozzit 0/10 on Signed-Releases, because releases ship a custom provenance.json that Scorecard does not recognise. A Sigstore *.intoto.jsonl bundle on the release is what it counts. The workbook is built and gated with native Excel on Windows, so CI cannot rebuild it. Instead this attests the tracked workbook at the signed tag, after checking that the draft's copy is byte-identical. No computed number, rate or threshold changes.

Verification

python -m ruff check .                                  # All checks passed!
python -m mypy --config-file mypy.ini                    # Success: no issues found in 34 source files
python -m unittest discover -s tools/tests               # Ran 679 tests, OK (skipped=1)
actionlint .github/workflows/attest-release.yml          # clean

tools/tests/test_repository_policy.py gains tests for the new workflow's policy: its trigger, permissions, verification steps, upload guards and the RELEASING.md step. Rust gates are unaffected: no file under tools/ozzit changes.

Final review

• Reviewed head commit: 92bb2cb
• Review type (self-review or independent): a Calvino review of the original commits, then an independent agent review of the rebased branch from a separate session (not a human review)
• Review record and scope: the full workflow, the RELEASING.md step and the policy tests, after rebasing onto Port the workbook tools to a Rust binary and run CI through it #224 (Rust workbook tools)
• Findings and disposition: Calvino requested changes and raised 5 findings. All were accepted and fixed in 60dc4a2 ("Bind the attestation upload to the verified draft and signed tag name"), and one hypothesis was left open in that review. The rebased review found one more issue, fixed in 92bb2cb: both jobs ran on ubuntu-latest, which GitHub is moving to Ubuntu 26, so they now pin ubuntu-24.04, as release-policy's release jobs do.
• Provider results and coverage gaps: CI had not run when this was written
• Remaining risks and unrun checks: the workflow has never run on GitHub, so the signing and upload paths are unproven until the next release's draft. The checks job uses release-policy a601f1d, the commit Ozzit's VirusTotal workflow already pins. Door: two-way; the workflow only runs when dispatched by hand. Blast radius: the next release's draft.

Checklist

• No client, taxpayer, employee or payroll data, and no credentials, tokens, tenant IDs or .env contents, appear in the diff, the commit messages or this description.
• The change is single-purpose.
• New or changed behaviour has a test that fails without the change.
• Documentation, README and any docstring that describes the changed rule were updated together with it.
• Any new dependency is justified in the description, or there is none.