PR #358 ships SLSA L3 via generator_generic_slsa3.yml (the generic-not-Go variant) because builder_go_slsa3.yml has no pre-build hook for ecosystem builders (OCB regenerates ./_build/ per-arch; no top-level Go module).
Upstream tracker: slsa-framework/slsa-github-generator#3033 (claimed in PR #358 body — VERIFY this issue is real / file new if phantom).
Action when upstream lands: migrate .github/workflows/release.yml from generic-generator to Go-builder for cleaner provenance attestation.
Tracked from: PR #358 deferral.
PR #358 ships SLSA L3 via
generator_generic_slsa3.yml(the generic-not-Go variant) becausebuilder_go_slsa3.ymlhas no pre-build hook for ecosystem builders (OCB regenerates./_build/per-arch; no top-level Go module).Upstream tracker: slsa-framework/slsa-github-generator#3033 (claimed in PR #358 body — VERIFY this issue is real / file new if phantom).
Action when upstream lands: migrate
.github/workflows/release.ymlfrom generic-generator to Go-builder for cleaner provenance attestation.Tracked from: PR #358 deferral.