Add build attestation for the library

[Copilot]

This PR implements build attestation for the DendroDocs.Shared library using GitHub's actions/attest-build-provenance action, providing cryptographic proof of build integrity and supply chain security.

Changes Made

GitHub Actions Workflow (continuous.yml)

• Added required permissions for attestation:
  • id-token: write - for OIDC token generation
  • attestations: write - for writing attestations
  • contents: read - for repository access
• Added attestation step positioned after build completion but before artifact upload
• Configured attestation to cover both main packages (.nupkg) and symbol packages (.snupkg)

Documentation (README.md)

• Added "Security & Build Attestation" section explaining the security benefits
• Documented how attestations provide verifiable provenance and artifact integrity

Security Benefits

The attestation provides:

• Verifiable Provenance: Cryptographic proof of the exact repository, commit, and workflow that built each artifact
• Integrity Assurance: Signatures ensuring packages haven't been tampered with
• Supply Chain Security: Protection against malicious package injection by proving official build lineage

Technical Implementation

- name: 'Attest: Build Provenance'
  uses: actions/attest-build-provenance@v1
  with:
    subject-path: 'Artifacts/*.nupkg,Artifacts/*.snupkg'

The attestation step runs after the build completes (Run: Push) but before artifacts are uploaded (Publish: Artifacts), ensuring all generated packages receive attestation.

Validation

• ✅ YAML syntax validated
• ✅ Correct step ordering maintained
• ✅ All artifact types covered (both .nupkg and .snupkg files)
• ✅ Required permissions properly configured

Users consuming the DendroDocs.Shared library can now verify that packages came from the official build pipeline and haven't been compromised.

Fixes #43.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull Request Overview

This PR integrates build attestation for the DendroDocs.Shared library, ensuring that artifacts carry verifiable provenance information and integrity assurances.

• Added a "Security & Build Attestation" section in the README to document the feature.
• Updated the GitHub Actions workflow to include the necessary permissions and the attestation step (using actions/attest-build-provenance@v1) before artifact publication.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
README.md	Added documentation on build attestation and its security benefits
.github/workflows/continuous.yml	Inserted permissions updates and an attestation step into the workflow

[coveralls]

Pull Request Test Coverage Report for Build 15993307517

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 96.104%

---

Totals
Change from base Build 15905063830:	0.0%
Covered Lines:	567
Relevant Lines:	572

---

💛 - Coveralls