feat(ci): add Sigstore attestation for release artifacts

Add build provenance attestation to the release workflow using
actions/attest-build-provenance with OIDC keyless signing.
Document release signature verification in SECURITY.md.

.github/workflows/release.yml

@@ -58,6 +58,10 @@ jobs:
   release:
     needs: build
     runs-on: self-hosted
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
     container:
       image: ubuntu:24.04
     steps:
@@ -145,6 +149,13 @@ jobs:
             opencodereview-*
             sha256sum.txt
 
+      - name: Attest release artifacts
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            opencodereview-*
+            sha256sum.txt
+
   npm-publish:
     needs: release
     runs-on: self-hosted

SECURITY.md

@@ -43,6 +43,22 @@ Out of scope:
 - Denial-of-service attacks that require local access.
 - Social engineering attacks.
 
+## Release Signatures
+
+All release binaries and checksums are signed using [GitHub Artifact Attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds) (Sigstore). Signatures are keyless — backed by GitHub Actions OIDC, with no long-lived private key. Version tags are signed with SSH keys via `git tag -s`.
+
+To verify a downloaded binary:
+
+```bash
+gh attestation verify opencodereview-linux-amd64 --repo alibaba/open-code-review
+```
+
+To verify a version tag:
+
+```bash
+git tag -v v1.6.4
+```
+
 ## Recognition
 
 We appreciate the security research community's efforts. Reporters who follow responsible disclosure will be credited in the release notes (unless they prefer to remain anonymous).

internal/llm/resolver.go

@@ -491,7 +491,7 @@ var reservedHeaders = map[string]bool{
 
 // ParseExtraHeaders parses a string of comma-separated key=value pairs into a dictionary.
 // Values may be double-quoted to include commas, e.g. X-Forwarded-For="1.2.3.4,5.6.7.8".
-// Reserved header names (authorization, x-api-key, content-type, user-agent) are rejected 
+// Reserved header names (authorization, x-api-key, content-type, user-agent) are rejected
 // to prevent accidental override of auth or content-type set by the SDK.
 func ParseExtraHeaders(raw string) (map[string]string, error) {
 	if raw == "" {