[codeforester]

Summary

• add a verification job that runs after provenance attestation and before publication
• make publication depend on that verification job
• verify both provenance and SPDX attestations against the exact reviewed source commit and release tag
• use build outputs rather than ambient GITHUB_SHA/GITHUB_REF in the final release verification

Security rationale

The previous graph allowed publish and attest to run in parallel, so publication was not contingent on a verified attestation. This makes attestation verification an explicit prerequisite while preserving least-privilege permissions.

Validation

• UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev pytest -q tests/test_package_workflow.py
• Ruff, YAML parsing, and git diff --check pass

Relates to #487.

[codeforester]

Implemented the review fix in commit 72f7412a.

• The build job now publishes a resolved source_ref output: the tag ref for tagged/rehearsal runs with a release tag, or the actual branch ref for branch-based workflow dispatch.
• Attestation verification consumes that output instead of constructing an empty refs/tags/ value when TestPyPI is rehearsed from a branch.
• Added regression assertions that prevent the old hard-coded tag expression from returning.

[codeforester]

Addressed the remaining review feedback in commit c8843ce7.

• Added attest explicitly to publish.needs instead of relying on a transitive dependency.
• Added a test that executes the workflow’s metadata step for a branch-based TestPyPI dispatch and verifies it emits the branch source_ref with an empty release tag.
• Fixed the quote-style formatting failure.

[codeforester]

The new commit (c8843ce7) correctly fixes both remaining points:

• publish's needs now explicitly lists attest alongside verify_attestations, removing the fragile transitive-only dependency.
• The new test_package_workflow_resolves_branch_source_ref_for_testpypi_dispatch test actually executes the metadata step's bash script with branch-dispatch inputs and asserts source_ref/source_ref_type/release_tag resolve correctly — this is exactly the regression test the original TestPyPI-rehearsal bug needed.

Same issue as #493 though: this new test fails the required Validate (windows-latest, Python 3.13) check (and the other Windows Python versions) — the subprocess.run(["bash", "-euo", "pipefail", "-c", ...], check=True) call itself raises CalledProcessError before any assertion runs, on every Windows job. Needs a fix for Windows runners (or skip there) before this can merge; everything else about the fix is correct.