Github attestation for Open3D binaries

[Copilot]

Type

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Motivation and Context

The GitHub Actions workflow files for Ubuntu and Windows contained non-robust context assumptions and hardcoded paths that can lead to skipped attestation steps or build drift if folder structures change. This PR resolves these workflow robustness issues.

Checklist:

• I have run python util/check_style.py --apply to apply Open3D code style
  to my code.
• This PR changes Open3D behavior or adds new functionality.
  • Both C++ (Doxygen) and Python (Sphinx / Google style) documentation is
    updated accordingly.
  • I have added or updated C++ and / or Python unit tests OR included test
    results (e.g. screenshots or numbers) here.
• I will follow up and update the code if CI fails.
• For fork PRs, I have selected Allow edits from maintainers.

Description

This pull request addresses Copilot reviews for CI workflow configuration reliability:

Ubuntu Workflow Improvements

• Context Consolidation: Replaced env.BUILD_SHARED_LIBS references in step if: expressions with matrix.BUILD_SHARED_LIBS directly in .github/workflows/ubuntu.yml. This ensures conditionals evaluate correctly even when env variables are not fully exported/populated at step initialization.

Windows Workflow Improvements

• Environment-based Path Tracking: Introduced a top-level INSTALL_DIR environment variable to represent the target installation prefix path (C:\Program Files\Open3D), removing hardcoded literal paths.
• Dynamic Path Resolution: Replaced the hardcoded literal path to CMakeCache.txt (C:/Open3D/build/CMakeCache.txt) by dynamically resolving it using $env:BUILD_DIR with PowerShell's Join-Path cmdlet.
• Improved Maintainability: Standardized installation path usage ($env:INSTALL_DIR / ${{ env.INSTALL_DIR }}) across target install configurations, ZIP archives, and cleanup routines.

For example, CMakeCache.txt and directory compression paths are now constructed dynamically:

$cmakeCachePath = Join-Path $env:BUILD_DIR "CMakeCache.txt"
$Env:OPEN3D_VERSION_FULL = (Select-String -Path $cmakeCachePath -Pattern "OPEN3D_VERSION_FULL").Line.Split('=')[1]
$open3dAppPath = Join-Path $env:INSTALL_DIR "bin\Open3D"
Compress-Archive -Path $open3dAppPath -DestinationPath `
  "$Env:GITHUB_WORKSPACE/open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip"

[update-docs]

Thanks for submitting this pull request! The maintainers of this repository would appreciate if you could update the CHANGELOG.md based on your changes.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds GitHub artifact attestation generation across Open3D’s release-producing GitHub Actions workflows to provide cryptographic provenance for built artifacts.

Changes:

• Grants id-token: write and attestations: write permissions to relevant workflow jobs.
• Adds actions/attest@v1 steps for packages, wheels, viewers, and documentation artifacts.
• Updates Windows viewer packaging to ZIP the viewer output before attesting and uploading.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.github/workflows/windows.yml	Adds attestations for devel package, viewer ZIP, and wheels; changes viewer packaging to create a ZIP prior to release update/upload.
.github/workflows/ubuntu.yml	Adds attestation generation for Linux devel package and viewer artifacts.
.github/workflows/ubuntu-wheel.yml	Adds attestation generation for CPU/GPU wheels prior to upload.
.github/workflows/ubuntu-sycl.yml	Adds attestation generation for SYCL wheel + devel package artifacts.
.github/workflows/ubuntu-openblas.yml	Adds wheel attestation generation prior to upload.
.github/workflows/ubuntu-cuda.yml	Adds package attestation generation prior to upload.
.github/workflows/macos.yml	Adds attestations for macOS packages, viewer ZIP, and wheels.
.github/workflows/documentation.yml	Adds attestation generation for the docs tarball prior to upload.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

[ssheorey]