[alexander-yevsyukov]

Part 3 of the Security section rollout.

The consumer-facing instructions for verifying our artifacts now live on spine.io, at Documentation → Security → Verifying artifacts. They were added in SpineEventEngine/documentation#88 and are linked from the org-wide SECURITY.md by SpineEventEngine/.github#8. That page is now the only full text.

What changed

• README.md, "Verifying published artifacts": shrunk from 47 lines to a pointer for maintainers. It keeps that every Publish run attests what it publishes, and that the comments in publishing.yml cover a failed attest job; for everything else, it links to the site. Dropped from here, and kept on the site in consumer terms:
  • the gh attestation verify command and its worked example;
  • why each flag is there;
  • choosing the branch;
  • older versions;
  • --signer-digest.
• .github-workflows/publish.yml: the maintainer-only note on the trigger moves from the README to a comment next to the trigger.
  • Publishing from v<major>.x release branches takes 'v*.x' added to the trigger in this template, not in a consumer's copy, which ./config/pull overwrites.
  • The template reaches every repository that publishes, so first each of their rulesets must cover that pattern, including the creation of such branches. Without that, verifying with --source-ref against such a branch no longer means reviewed code.
  • A config:replaces variant isn't suggested: migrate pins only the distributed publish.yml to the config commit, so a variant would drift from buildSrc.

The comment reaches consumers' publish.yml with their next ./config/pull. migrate only rewrites the publishing.yml@CONFIG_COMMIT reference, so a comment above on: doesn't affect it.

Checks

• The new link returns 200, and GitHub renders the section with it resolved.
• actionlint passes on the edited template.

This branch was made from origin/master in a separate worktree. It doesn't overlap the hugo-wrapper-validation work, which edits other parts of README.md.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-01T14:21:50.874582Z	6fc2e46	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6fc2e46d36

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".