Implement build provenance attestations before release creation

[Copilot]

Build provenance attestations must be created before publishing releases to ensure proper artifact association at publication time.

Changes

• Workflow order corrected: Attestation steps (lines 509-517) now execute before Create GitHub Release (line 519)
• Documentation updated: All references changed from conditional ("can be immutable when enabled") to declarative ("are immutable") since immutability is enabled in repository settings

Implementation

- name: Attest build provenance for SBOM
  uses: actions/attest-build-provenance@v2
  with:
    subject-path: ./bom.json

- name: Attest build provenance for build artifacts
  uses: actions/attest-build-provenance@v2
  with:
    subject-path: 'dist/*'

- name: Create GitHub Release  # Attestations created first
  uses: softprops/action-gh-release@v2

Attestations are cryptographically signed and verifiable via gh attestation verify.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Implement Immutable Releases</issue_title>
<issue_description>https://github.blog/changelog/2025-10-28-immutable-releases-are-now-generally-available/</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Implement Immutable Releases #114

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This pull request implements GitHub's Immutable Releases feature with build provenance attestations to enhance supply chain security for DedPaste releases. The changes add cryptographic attestation generation to the release workflow and provide comprehensive documentation for users to verify release authenticity.

Changes:

• Added attestations: write permission and build provenance attestation steps using actions/attest-build-provenance@v2 to the release workflow
• Updated release notes generation to include verification instructions for attestations
• Added verification section to README.md with examples of using gh attestation verify
• Created comprehensive RELEASE-PROCESS.md documentation covering the full release process, attestation verification, and troubleshooting

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/release-with-sbom.yml	Added attestation permissions and attestation steps for SBOM and build artifacts; updated release notes to include verification instructions
README.md	Added verification section demonstrating how to verify release artifacts using GitHub CLI attestation commands
docs/RELEASE-PROCESS.md	New comprehensive documentation explaining the release process, immutable releases feature, attestation implementation, verification steps, and troubleshooting guidance