Add attestation to releases #453

	name: CI

	on:
	push:
	branches: [ main ]
	pull_request:
	branches: [ main ]

	# Security: Set minimal permissions by default
	permissions:
	contents: read

	jobs:
	test:
	runs-on: ${{ matrix.os }}
	strategy:
	matrix:
	os: [ubuntu-latest, macos-latest]
	ruby-version: ['3.2', '3.3', '3.4', '4.0']

	steps:
	# Security: Pin to commit SHA instead of tag to prevent tag hijacking
	# actions/checkout@v4.3.1
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Set up Ruby
	# Security: Pin to commit SHA instead of tag
	# ruby/setup-ruby@v1.295.0
	uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
	with:
	ruby-version: ${{ matrix.ruby-version }}
	bundler: 'latest'
	bundler-cache: true

	# Security: Provide secrets only to the step that needs them, not all steps
	- name: Run CI verification
	run: bundle exec rake ci
	env:
	BRAINTRUST_API_KEY: ${{ secrets.BRAINTRUST_API_KEY }}
	OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
	ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

	ensure-pinned-actions:
	runs-on: ubuntu-24.04
	timeout-minutes: 2
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	- run: bash scripts/ensure-pinned-actions.sh

	# Summary job that requires all matrix tests to pass
	# This is what branch protection will check
	ci-success:
	name: CI Success
	needs: [test, ensure-pinned-actions]
	runs-on: ubuntu-24.04
	if: always()
	steps:
	- name: Check test matrix success
	run: \|
	if [ "${{ needs.test.result }}" != "success" ]; then
	echo "Test matrix failed"
	exit 1
	fi
	echo "All tests passed!"

Provide feedback