The provenance file generated perfectly. Build completed. Release uploaded.
slsa-verifier failed:
Same workflow that worked last month. Nothing changed.
Except everything changed.
The workflows had been running for months. Cosign signing. SBOM generation. Release automation.
Everything worked.
Then OpenSSF Scorecard ran: 16 Token-Permissions alerts.
The code scanning tab filled with warnings. All from one workflow file.
The releases were signed. Checksums published. SBOM generated. Every asset had a Cosign signature.
OpenSSF Scorecard: Signed-Releases 8/10.
Not 9. Not 10. Eight. Stuck.