From fe5a6ba2d4ff10fc14762d039b4ef21a8a9ffbd2 Mon Sep 17 00:00:00 2001
From: Frans van Dorsselaer <17404029+dorssel@users.noreply.github.com>
Date: Sat, 17 Oct 2026 10:00:34 +0200
Subject: [PATCH 1/2] Add SLSA

---
 .github/workflows/slsa.yml | 77 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 77 insertions(+)
 create mode 100644 .github/workflows/slsa.yml

diff --git a/.github/workflows/slsa.yml b/.github/workflows/slsa.yml
new file mode 100644
index 0000000..4ad21ef
--- /dev/null
+++ b/.github/workflows/slsa.yml
@@ -0,0 +1,77 @@
+# SPDX-FileCopyrightText: 2026 Frans van Dorsselaer
+#
+# SPDX-License-Identifier: MIT
+
+---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+
+name: SLSA
+
+on:
+  workflow_dispatch:
+    inputs:
+      # checkov:skip=CKV_GHA_7: Required input for generating SLSA provenance for an existing release.
+      tag_name:
+        description: 'The existing release tag to generate provenance for (e.g., v1.2.0)'
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  subjects:
+    name: Subjects
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    outputs:
+      hashes: ${{ steps.compute-hashes.outputs.hashes }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Download Existing Release Assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE: ${{ inputs.tag_name }}
+        run: |
+          gh release download "${RELEASE}" --dir release-artifacts
+
+      - name: Fail if provenance already exists
+        run: |
+          shopt -s nullglob
+          PROVENANCE=(release-artifacts/*.intoto.jsonl)
+          if [ ${#PROVENANCE[@]} -gt 0 ]; then
+            echo "Provenance file(s) already exist."
+            exit 1
+          fi
+
+      - name: Compute Hashes
+        id: compute-hashes
+        shell: bash
+        run: |
+          cd release-artifacts
+          shopt -s dotglob
+          ASSETS=(*)
+          echo "hashes=$(sha256sum -- "${ASSETS[@]}" | base64 -w0)" >> "$GITHUB_OUTPUT"
+
+  provenance:
+    needs: [subjects]
+    # This will fail, because generator_generic_slsa3 demands using version pinning, instead of hash pinning.
+    # Instead, use the workflow from the 'slsa' branch.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0
+
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+
+    with:
+      base64-subjects: ${{ needs.subjects.outputs.hashes }}
+      upload-assets: true
+      upload-tag-name: ${{ inputs.tag_name }}

From b9e0c507572ebed4e494c00a121393d70b1dbcc3 Mon Sep 17 00:00:00 2001
From: Frans van Dorsselaer <17404029+dorssel@users.noreply.github.com>
Date: Sat, 17 Oct 2026 10:01:15 +0200
Subject: [PATCH 2/2] Add NuGet publish workflow

---
 .github/workflows/nuget.yml | 71 +++++++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 .github/workflows/nuget.yml

diff --git a/.github/workflows/nuget.yml b/.github/workflows/nuget.yml
new file mode 100644
index 0000000..e9a586a
--- /dev/null
+++ b/.github/workflows/nuget.yml
@@ -0,0 +1,71 @@
+# SPDX-FileCopyrightText: 2026 Frans van Dorsselaer
+#
+# SPDX-License-Identifier: MIT
+
+---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
+
+name: NuGet
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+    inputs:
+      # checkov:skip=CKV_GHA_7: Required input for publishing an existing release to NuGet.
+      tag_name:
+        description: 'The existing release tag to publish (e.g., v1.2.0)'
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          cache: false
+
+      - name: Download Release Assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_TAG: |-
+            ${{ case(
+              github.event_name == 'release', github.event.release.tag_name,
+              github.event_name == 'workflow_dispatch', github.event.inputs.tag_name,
+              'unknown'
+            ) }}
+        run: |
+          gh release download "${RELEASE_TAG}" --dir release-artifacts
+
+      - name: NuGet Login (Trusted Publishing)
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
+        id: login
+        with:
+          user: dorssel
+
+      - name: Push to NuGet
+        env:
+          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY }}
+        run: |
+          PACKAGES=(./release-artifacts/*.nupkg)
+          dotnet nuget push \
+            "${PACKAGES[@]}" \
+            --api-key "${NUGET_API_KEY}" \
+            --source https://api.nuget.org/v3/index.json \
+            --skip-duplicate \
+            --force-english-output