publish-with-receipts

This reference project turns a PowerShell Summit 2026 talk into a working example of package provenance with GitHub Actions.

The argument is simple: PowerShell and Chocolatey lack some of the enforceable supply-chain plumbing other package ecosystems take for granted. The repository demonstrates how signed build provenance, verifiable source, and automated receipts can close part of that gap.