Merge pull request #170 from braintrustdata/ci/attestation

Add attestation to releases

Author: delner

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+/lib/                   @braintrustdata/sdk-eng
+/*.gemspec              @braintrustdata/sdk-eng
+/.github/               @braintrustdata/sdk-eng
+/scripts/               @braintrustdata/sdk-eng

.github/workflows/ci.yml

@@ -21,12 +21,12 @@ jobs:
     steps:
     # Security: Pin to commit SHA instead of tag to prevent tag hijacking
     # actions/checkout@v4.3.1
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Set up Ruby
       # Security: Pin to commit SHA instead of tag
       # ruby/setup-ruby@v1.295.0
-      uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f
+      uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1.310.0
       with:
         ruby-version: ${{ matrix.ruby-version }}
         bundler: 'latest'
@@ -41,18 +41,18 @@ jobs:
         ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
 
   ensure-pinned-actions:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - run: bash scripts/ensure-pinned-actions.sh
 
   # Summary job that requires all matrix tests to pass
   # This is what branch protection will check
   ci-success:
     name: CI Success
     needs: [test, ensure-pinned-actions]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: always()
     steps:
       - name: Check test matrix success