[dependabot]

Bumps nix-forge/ci/.github/workflows/slsa-source-release.yml from b6b3f55 to 57f57d1.

Changelog

Sourced from nix-forge/ci/.github/workflows/slsa-source-release.yml's changelog.

Release process

The CI library uses immutable semantic-version tags in the v2.x series. A release starts from a reviewed commit on main after the pull request has passed workflow validation, dependency review, CodeQL, the DCO check, and the repository test suite.

Candidate checklist

1. Create docs/releases/v2.x.y.md for the exact tag. It must contain a ## Changelog section with functional and security changes, affected callers, migration notes, and the checks and support window for the release. The release workflow rejects a tag without this file.
2. Run nix flake check, scripts/check.sh, and the complete Python test suite.
3. Run a representative caller repository against the candidate commit.
4. Run scripts/sync-release.py in check mode for all known callers before publishing a new shared release.
5. Tag the exact reviewed commit. Do not tag a dirty working tree.
6. Verify the release using the commands below before announcing it.

Verification

For example:

gh release download v2.x.y --repo nix-forge/ci --dir release-v2.x.y
(cd release-v2.x.y && sha256sum -c nix-forge-ci-v2.x.y.tar.gz.sha256)
gh attestation verify release-v2.x.y/nix-forge-ci-v2.x.y.tar.gz \
  --repo nix-forge/ci \
  --bundle release-v2.x.y/nix-forge-ci-v2.x.y.intoto.jsonl \
  --signer-workflow nix-forge/ci/.github/workflows/slsa-source-release.yml \
  --signer-digest <BUILDER_COMMIT_SHA>

The expected release identity is the nix-forge/ci repository and the pinned nix-forge/ci/.github/workflows/slsa-source-release.yml reusable builder. Keep the digest equal to the reviewed reusable builder pin in .github/workflows/release.yml at the tag being verified.

The reusable builder creates a source archive, a SHA-256 file, a release manifest, and an OIDC-backed SLSA build attestation before the protected publisher job receives the files. It exports the attestation as a portable .intoto.jsonl release asset so verification does not depend on an online attestation lookup. The publisher verifies the exact tag, bytes, bundle, and signer workflow before creating a draft GitHub Release, then publishes it only after all assets are attached. This work runs only for release tags and adds no pull-request or merge-queue jobs. It is required for immutable-release repositories. It does not publish opaque compiled assets. Release notes name the actor and workflow, list public inputs and outputs, describe the security assessment, and state the support and end-of-life window. A release stops

... (truncated)

Commits

• 57f57d1 build(deps): bump nixpkgs from c59305b to 6510408 (#86)
• 4ebd758 build(deps): bump the actions-minor-patch group across 3 directories with 7 u...
• 1a6dfe0 Keep package-source reconciliation within the repository API budget (#84)
• e838f2c ci: advance automated merge queues after validation (#83)
• ab8e486 fix(queue): recover source callbacks and asynchronous queue advance (#82)
• 1e0a32f test(queue): exercise source run provenance guards (#81)
• 1845f37 fix(queue): reconcile verified package source PRs (#80)
• 50f46de ci: use published v2.10.0 for shared self-validation workflows (#78)
• 32dec09 fix: automate safe dependency updates and recover CI API failures (#77)
• 043d4ff build(deps): bump nix-forge/ci/.github/workflows/slsa-source-release.yml (#76)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)