fix(ci): attest releases and validate offline examples

.github/workflows/auto-release.yml

@@ -131,6 +131,8 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     needs: build
     runs-on: ubuntu-latest
     steps:
@@ -143,6 +145,14 @@ jobs:
       - name: Recheck artifact checksums
         run: (cd dist && sha256sum -c SHA256SUMS)
 
+      - name: Attest tagged release artifacts
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        with:
+          subject-path: |
+            dist/docker_practice-*.pdf
+            dist/docker_practice-*.html
+            dist/SHA256SUMS
+
       - name: Create GitHub release
         uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:

.github/workflows/pages.yml

@@ -54,7 +54,9 @@ jobs:
         run: npm run build
 
       - name: Verify site output
-        run: test -s _site/index.html
+        run: |
+          title=$(python3 -c 'import json; print(json.load(open("book.json", encoding="utf-8"))["title"])')
+          python3 tools/verify_artifacts.py --title "$title" --site _site
 
       - name: Configure Pages
         uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0

.github/workflows/preview-pdf.yml

@@ -108,6 +108,8 @@ jobs:
           - Branch: \`${GITHUB_REF_NAME}\`
           - Commit: https://github.com/${GITHUB_REPOSITORY}/commit/${GITHUB_SHA}
           - Run: https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}
+
+          This is a mutable preview without formal provenance. Use a tagged release for attested artifacts.
           EOF
 
       - name: Create preview release when absent