From cd231fd369bec1a2093f1f5d9f52a1957e30847f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:37:38 +0000
Subject: [PATCH 1/9] Add artifact attestation steps and permissions to release
 workflows

---
 .github/workflows/documentation.yml   |  7 +++++++
 .github/workflows/macos.yml           | 21 +++++++++++++++++++++
 .github/workflows/ubuntu-cuda.yml     |  8 ++++++++
 .github/workflows/ubuntu-openblas.yml |  7 +++++++
 .github/workflows/ubuntu-sycl.yml     | 10 ++++++++++
 .github/workflows/ubuntu-wheel.yml    |  8 ++++++++
 .github/workflows/ubuntu.yml          | 15 +++++++++++++++
 .github/workflows/windows.yml         | 21 +++++++++++++++++++++
 8 files changed, 97 insertions(+)

diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index e6ddcc54fef..780d682c152 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -22,6 +22,8 @@ jobs:
   headless-docs:   # Build headless and docs
     permissions:
       contents: write  # Artifact upload and release upload
+      id-token: write
+      attestations: write
     runs-on: ubuntu-latest
     env:
       DEVELOPER_BUILD: ${{ github.event.inputs.developer_build || 'ON' }}
@@ -49,6 +51,11 @@ jobs:
           # Rename from Github PR branch SHA to original branch SHA, if needed.
           mv open3d-*-docs.tar.gz open3d-${GITHUB_SHA}-docs.tar.gz
 
+      - name: Generate docs attestation
+        uses: actions/attest@v1
+        with:
+          subject-path: open3d-${{ github.sha }}-docs.tar.gz
+
       - name: Upload docs
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index 381f82772d9..b78e00c7282 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -29,6 +29,8 @@ jobs:
   MacOS:
     permissions:
       contents: write  # upload
+      id-token: write
+      attestations: write
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -86,6 +88,12 @@ jobs:
           zip -rv "open3d-${OPEN3D_VERSION_FULL}-app-macosx-10_15-${{ runner.arch }}.zip" Open3D.app
           ccache -s
 
+      - name: Generate package attestation
+        if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
+        uses: actions/attest@v1
+        with:
+          subject-path: build/package/${{ env.DEVEL_PKG_NAME }}
+
       - name: Upload package
         if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
         uses: actions/upload-artifact@v4
@@ -94,6 +102,12 @@ jobs:
           path: build/package/${{ env.DEVEL_PKG_NAME }}
           if-no-files-found: error
 
+      - name: Generate viewer attestation
+        if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
+        uses: actions/attest@v1
+        with:
+          subject-path: build/bin/open3d-*-app-macosx-10_15-${{ runner.arch }}.zip
+
       - name: Upload Open3D viewer app
         uses: actions/upload-artifact@v4
         if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
@@ -117,6 +131,8 @@ jobs:
     name: Build wheel
     permissions:
       contents: write  # upload
+      id-token: write
+      attestations: write
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -199,6 +215,11 @@ jobs:
           PIP_PKG_NAME="$(basename build/lib/python_package/pip_package/open3d*.whl)"
           echo "PIP_PKG_NAME=$PIP_PKG_NAME" >> $GITHUB_ENV
 
+      - name: Generate wheel attestation
+        uses: actions/attest@v1
+        with:
+          subject-path: build/lib/python_package/pip_package/${{ env.PIP_PKG_NAME }}
+
       - name: Upload wheel
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/ubuntu-cuda.yml b/.github/workflows/ubuntu-cuda.yml
index cfd9d62945e..672f91c209e 100644
--- a/.github/workflows/ubuntu-cuda.yml
+++ b/.github/workflows/ubuntu-cuda.yml
@@ -47,6 +47,8 @@ jobs:
     name: Build and run
     permissions:
       contents: write   # upload
+      id-token: write
+      attestations: write
     runs-on: ubuntu-latest
     needs: [skip-check]
     if: needs.skip-check.outputs.skip == 'no'
@@ -151,6 +153,12 @@ jobs:
               "${INSTANCE_NAME}":open3d-devel-linux*.tar.xz "$PWD"
           fi
 
+      - name: Generate package attestation
+        if: ${{ env.BUILD_PACKAGE == 'true' }}
+        uses: actions/attest@v1
+        with:
+          subject-path: open3d-devel-linux*.tar.xz
+
       - name: Upload package
         if: ${{ env.BUILD_PACKAGE == 'true' }}
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ubuntu-openblas.yml b/.github/workflows/ubuntu-openblas.yml
index dc625dd4c9e..95005cf9964 100644
--- a/.github/workflows/ubuntu-openblas.yml
+++ b/.github/workflows/ubuntu-openblas.yml
@@ -37,6 +37,8 @@ jobs:
   openblas-arm64:
     permissions:
       contents: write  # Release upload
+      id-token: write
+      attestations: write
     runs-on: ubuntu-24.04-arm   # latest
     strategy:
       fail-fast: false
@@ -83,6 +85,11 @@ jobs:
       - name: Docker test
         run: docker/docker_test.sh "${DOCKER_TAG}"
 
+      - name: Generate wheel attestation
+        uses: actions/attest@v1
+        with:
+          subject-path: ${{ env.PIP_PKG_NAME }}
+
       - name: Upload wheel to GitHub artifacts
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/ubuntu-sycl.yml b/.github/workflows/ubuntu-sycl.yml
index 3f9ca4edf71..4d8692d450f 100644
--- a/.github/workflows/ubuntu-sycl.yml
+++ b/.github/workflows/ubuntu-sycl.yml
@@ -26,6 +26,8 @@ jobs:
   ubuntu-sycl:
     permissions:
       contents: write  # Release upload
+      id-token: write
+      attestations: write
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -54,6 +56,14 @@ jobs:
             docker/docker_test.sh sycl-static
           fi
 
+      - name: Generate artifact attestation
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' }}
+        uses: actions/attest@v1
+        with:
+          subject-path: |
+            open3d*.whl
+            open3d-devel-*.tar.xz
+
       - name: Upload Python wheel and C++ binary package to GitHub artifacts
         if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' }}
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ubuntu-wheel.yml b/.github/workflows/ubuntu-wheel.yml
index e8a340e5d8f..0fd9580c441 100644
--- a/.github/workflows/ubuntu-wheel.yml
+++ b/.github/workflows/ubuntu-wheel.yml
@@ -26,6 +26,8 @@ jobs:
   build-wheel:
     permissions:
       contents: write  # Release upload
+      id-token: write
+      attestations: write
     name: Build wheel
     runs-on: ubuntu-latest
     strategy:
@@ -88,6 +90,12 @@ jobs:
           PIP_CPU_PKG_NAME="$(basename ${GITHUB_WORKSPACE}/open3d_cpu*.whl)"
           echo "PIP_PKG_NAME=$PIP_PKG_NAME" >> $GITHUB_ENV
           echo "PIP_CPU_PKG_NAME=$PIP_CPU_PKG_NAME" >> $GITHUB_ENV
+      - name: Generate artifact attestation
+        uses: actions/attest@v1
+        with:
+          subject-path: |
+            ${{ env.PIP_PKG_NAME }}
+            ${{ env.PIP_CPU_PKG_NAME }}
       - name: Upload wheel to GitHub artifacts
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index e7e27444ca2..fe2b8e9696d 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -22,6 +22,8 @@ jobs:
   ubuntu:
     permissions:
       contents: write  # Release upload
+      id-token: write
+      attestations: write
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -62,6 +64,12 @@ jobs:
           elif [ "${{ matrix.BUILD_SHARED_LIBS }}" = "ON"  ] && [ "${{ env.MLOPS }}" = "ON"  ] && [ "${{ env.DEVELOPER_BUILD }}" = "OFF" ]; then
             docker/docker_test.sh cpu-shared-ml-release
           fi
+      - name: Generate package attestation
+        if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
+        uses: actions/attest@v1
+        with:
+          subject-path: open3d-devel-*.tar.xz
+
       - name: Upload package to GitHub artifacts
         if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
         uses: actions/upload-artifact@v4
@@ -69,6 +77,13 @@ jobs:
           name: open3d-devel-linux-x86_64
           path: open3d-devel-*.tar.xz
           if-no-files-found: error
+
+      - name: Generate viewer attestation
+        if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
+        uses: actions/attest@v1
+        with:
+          subject-path: open3d-viewer-*-Linux.deb
+
       - name: Upload viewer to GitHub artifacts
         if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index d571f97e295..28170ac0eaa 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -38,6 +38,8 @@ jobs:
   windows:
     permissions:
       contents: write  # upload
+      id-token: write
+      attestations: write
     runs-on: windows-2022
     strategy:
       fail-fast: false
@@ -171,6 +173,12 @@ jobs:
           echo "DEVEL_PKG_NAME=$DEVEL_PKG_NAME" | Out-File -FilePath `
             $Env:GITHUB_ENV -Encoding utf8 -Append
 
+      - name: Generate package attestation
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' }}
+        uses: actions/attest@v1
+        with:
+          subject-path: ${{ env.BUILD_DIR }}/package/${{ env.DEVEL_PKG_NAME }}
+
       - name: Upload Package
         if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' }}
         uses: actions/upload-artifact@v4
@@ -198,6 +206,12 @@ jobs:
           cmake --build . --parallel ${{ env.NPROC }} --config ${{ matrix.CONFIG }} `
             --target INSTALL
 
+      - name: Generate viewer attestation
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' && matrix.STATIC_RUNTIME == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' && matrix.CONFIG == 'Release' }}
+        uses: actions/attest@v1
+        with:
+          subject-path: C:\Program Files\Open3D\bin\Open3D\**\*
+
       - name: Upload Viewer
         if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' && matrix.STATIC_RUNTIME == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' && matrix.CONFIG == 'Release' }}
         uses: actions/upload-artifact@v4
@@ -261,6 +275,8 @@ jobs:
     name: Build wheel
     permissions:
       contents: write  # upload
+      id-token: write
+      attestations: write
     runs-on: windows-2022
     strategy:
       fail-fast: false
@@ -351,6 +367,11 @@ jobs:
           $PIP_PKG_NAME=(Get-ChildItem lib/python_package/pip_package/open3d*.whl).Name
           echo "PIP_PKG_NAME=$PIP_PKG_NAME"  | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
 
+      - name: Generate wheel attestation
+        uses: actions/attest@v1
+        with:
+          subject-path: ${{ env.BUILD_DIR }}/lib/python_package/pip_package/${{ env.PIP_PKG_NAME }}
+
       - name: Upload wheel
         uses: actions/upload-artifact@v4
         with:

From 81250de0c39712d0d51a0bf3b2d0db3d6ba3e879 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:39:38 +0000
Subject: [PATCH 2/9] Refine attestation subject-paths to use absolute paths
 and zip file for Windows viewer

---
 .github/workflows/documentation.yml   |  2 +-
 .github/workflows/ubuntu-cuda.yml     |  2 +-
 .github/workflows/ubuntu-openblas.yml |  2 +-
 .github/workflows/ubuntu-sycl.yml     |  4 ++--
 .github/workflows/ubuntu-wheel.yml    |  4 ++--
 .github/workflows/ubuntu.yml          |  4 ++--
 .github/workflows/windows.yml         | 12 +++++++-----
 7 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 780d682c152..78077c66f96 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -54,7 +54,7 @@ jobs:
       - name: Generate docs attestation
         uses: actions/attest@v1
         with:
-          subject-path: open3d-${{ github.sha }}-docs.tar.gz
+          subject-path: ${{ github.workspace }}/open3d-${{ github.sha }}-docs.tar.gz
 
       - name: Upload docs
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ubuntu-cuda.yml b/.github/workflows/ubuntu-cuda.yml
index 672f91c209e..39529db7879 100644
--- a/.github/workflows/ubuntu-cuda.yml
+++ b/.github/workflows/ubuntu-cuda.yml
@@ -157,7 +157,7 @@ jobs:
         if: ${{ env.BUILD_PACKAGE == 'true' }}
         uses: actions/attest@v1
         with:
-          subject-path: open3d-devel-linux*.tar.xz
+          subject-path: ${{ github.workspace }}/open3d-devel-linux*.tar.xz
 
       - name: Upload package
         if: ${{ env.BUILD_PACKAGE == 'true' }}
diff --git a/.github/workflows/ubuntu-openblas.yml b/.github/workflows/ubuntu-openblas.yml
index 95005cf9964..f60492d7b2a 100644
--- a/.github/workflows/ubuntu-openblas.yml
+++ b/.github/workflows/ubuntu-openblas.yml
@@ -88,7 +88,7 @@ jobs:
       - name: Generate wheel attestation
         uses: actions/attest@v1
         with:
-          subject-path: ${{ env.PIP_PKG_NAME }}
+          subject-path: ${{ github.workspace }}/${{ env.PIP_PKG_NAME }}
 
       - name: Upload wheel to GitHub artifacts
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/ubuntu-sycl.yml b/.github/workflows/ubuntu-sycl.yml
index 4d8692d450f..0d911bca7ba 100644
--- a/.github/workflows/ubuntu-sycl.yml
+++ b/.github/workflows/ubuntu-sycl.yml
@@ -61,8 +61,8 @@ jobs:
         uses: actions/attest@v1
         with:
           subject-path: |
-            open3d*.whl
-            open3d-devel-*.tar.xz
+            ${{ github.workspace }}/open3d*.whl
+            ${{ github.workspace }}/open3d-devel-*.tar.xz
 
       - name: Upload Python wheel and C++ binary package to GitHub artifacts
         if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' }}
diff --git a/.github/workflows/ubuntu-wheel.yml b/.github/workflows/ubuntu-wheel.yml
index 0fd9580c441..79093c0454e 100644
--- a/.github/workflows/ubuntu-wheel.yml
+++ b/.github/workflows/ubuntu-wheel.yml
@@ -94,8 +94,8 @@ jobs:
         uses: actions/attest@v1
         with:
           subject-path: |
-            ${{ env.PIP_PKG_NAME }}
-            ${{ env.PIP_CPU_PKG_NAME }}
+            ${{ github.workspace }}/${{ env.PIP_PKG_NAME }}
+            ${{ github.workspace }}/${{ env.PIP_CPU_PKG_NAME }}
       - name: Upload wheel to GitHub artifacts
         uses: actions/upload-artifact@v4
         with:
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index fe2b8e9696d..3faab6d5832 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -68,7 +68,7 @@ jobs:
         if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
         uses: actions/attest@v1
         with:
-          subject-path: open3d-devel-*.tar.xz
+          subject-path: ${{ github.workspace }}/open3d-devel-*.tar.xz
 
       - name: Upload package to GitHub artifacts
         if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
@@ -82,7 +82,7 @@ jobs:
         if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
         uses: actions/attest@v1
         with:
-          subject-path: open3d-viewer-*-Linux.deb
+          subject-path: ${{ github.workspace }}/open3d-viewer-*-Linux.deb
 
       - name: Upload viewer to GitHub artifacts
         if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 28170ac0eaa..1ea03fdf1fd 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -205,12 +205,17 @@ jobs:
             --target Open3DViewer
           cmake --build . --parallel ${{ env.NPROC }} --config ${{ matrix.CONFIG }} `
             --target INSTALL
+          $Env:OPEN3D_VERSION_FULL = (Select-String -Path "CMakeCache.txt" -Pattern "OPEN3D_VERSION_FULL").Line.Split('=')[1]
+          Compress-Archive -Path "C:/Program Files/Open3D/bin/Open3D" -DestinationPath `
+            "$Env:GITHUB_WORKSPACE/open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip"
+          echo "VIEWER_ZIP_NAME=open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip" | Out-File -FilePath `
+            $Env:GITHUB_ENV -Encoding utf8 -Append
 
       - name: Generate viewer attestation
         if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' && matrix.STATIC_RUNTIME == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' && matrix.CONFIG == 'Release' }}
         uses: actions/attest@v1
         with:
-          subject-path: C:\Program Files\Open3D\bin\Open3D\**\*
+          subject-path: ${{ github.workspace }}/${{ env.VIEWER_ZIP_NAME }}
 
       - name: Upload Viewer
         if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' && matrix.STATIC_RUNTIME == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' && matrix.CONFIG == 'Release' }}
@@ -225,10 +230,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          $Env:OPEN3D_VERSION_FULL = (Select-String -Path "C:/Open3D/build/CMakeCache.txt" -Pattern "OPEN3D_VERSION_FULL").Line.Split('=')[1]
-          Compress-Archive -Path "C:/Program Files/Open3D/bin/Open3D" -DestinationPath `
-            "open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip"
-          bash .github/workflows/update_release.sh "open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip"
+          bash .github/workflows/update_release.sh "${{ env.VIEWER_ZIP_NAME }}"
 
       - name: Run C++ unit tests
         if: ${{ matrix.BUILD_CUDA_MODULE == 'OFF' }}

From 4bbee18eef4023f2149163d03e609910793c71bf Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 12 Jun 2026 21:40:20 +0000
Subject: [PATCH 3/9] Use explicit path for CMakeCache.txt in windows.yml

---
 .github/workflows/windows.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 1ea03fdf1fd..1a1d5be5846 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -205,7 +205,7 @@ jobs:
             --target Open3DViewer
           cmake --build . --parallel ${{ env.NPROC }} --config ${{ matrix.CONFIG }} `
             --target INSTALL
-          $Env:OPEN3D_VERSION_FULL = (Select-String -Path "CMakeCache.txt" -Pattern "OPEN3D_VERSION_FULL").Line.Split('=')[1]
+          $Env:OPEN3D_VERSION_FULL = (Select-String -Path "C:/Open3D/build/CMakeCache.txt" -Pattern "OPEN3D_VERSION_FULL").Line.Split('=')[1]
           Compress-Archive -Path "C:/Program Files/Open3D/bin/Open3D" -DestinationPath `
             "$Env:GITHUB_WORKSPACE/open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip"
           echo "VIEWER_ZIP_NAME=open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip" | Out-File -FilePath `

From 319145d4a901c3d9f50730a81a479ba6457b9b6d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 15 Jun 2026 23:10:43 +0000
Subject: [PATCH 4/9] Create workflow fixes plan and document requirements

---
 workflow_fixes_plan.md | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 workflow_fixes_plan.md

diff --git a/workflow_fixes_plan.md b/workflow_fixes_plan.md
new file mode 100644
index 00000000000..a0a232c8fd9
--- /dev/null
+++ b/workflow_fixes_plan.md
@@ -0,0 +1,29 @@
+# Plan: Address Copilot Workflow Reviews
+
+## Goal
+Address Copilot workflow reviews for `ubuntu.yml` and `windows.yml` to make them more robust and maintainable.
+
+## Requirements
+1. **`ubuntu.yml`**:
+   - Use `matrix.BUILD_SHARED_LIBS` consistently in `if:` expressions instead of `env.BUILD_SHARED_LIBS` to ensure attestation and artifact steps execute correctly.
+2. **`windows.yml`**:
+   - Avoid hard-coded paths like `C:/Open3D/build/CMakeCache.txt` and `C:/Program Files/Open3D/...`.
+   - Track/define installation path as `INSTALL_DIR` at the workflow environment level.
+   - Construct `CMakeCache.txt` path and Open3D application binary path using `$env:BUILD_DIR`, `$env:INSTALL_DIR`, and PowerShell `Join-Path`.
+
+## Implementation Steps
+- [x] Create `workflow_fixes_plan.md` to document research and decisions.
+- [ ] Modify `.github/workflows/ubuntu.yml` to replace `env.BUILD_SHARED_LIBS` with `matrix.BUILD_SHARED_LIBS` in `if:` expressions of the attestation/upload steps.
+- [ ] Modify `.github/workflows/windows.yml` to define `INSTALL_DIR: "C:\\Program Files\\Open3D"` in the workflow environment.
+- [ ] Replace hard-coded `"C:/Open3D/build/CMakeCache.txt"` in `windows.yml` with a path joined dynamically via `Join-Path`.
+- [ ] Replace hard-coded `"C:/Program Files/Open3D"` references with the `INSTALL_DIR` environment variable.
+- [ ] Run validation.
+
+## Test Method
+Since we are only modifying CI/CD workflows and cannot run GitHub Actions locally, we will:
+1. Verify syntax of the modified YAML files.
+2. Ensure that GHA syntax is correct.
+
+## Risks and Mitigations
+- **Risk**: Syntactical errors in GitHub Actions workflow YAML.
+- **Mitigation**: Double-check indentation, quotes, and GHA expression syntax before committing.

From c2df75badbcbf41581d3b3fa9f13bf5605c49c66 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 15 Jun 2026 23:10:55 +0000
Subject: [PATCH 5/9] Use matrix.BUILD_SHARED_LIBS in if: expressions in
 ubuntu.yml

---
 .github/workflows/ubuntu.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 3faab6d5832..92663869bae 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -65,13 +65,13 @@ jobs:
             docker/docker_test.sh cpu-shared-ml-release
           fi
       - name: Generate package attestation
-        if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' }}
         uses: actions/attest@v1
         with:
           subject-path: ${{ github.workspace }}/open3d-devel-*.tar.xz
 
       - name: Upload package to GitHub artifacts
-        if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' }}
         uses: actions/upload-artifact@v4
         with:
           name: open3d-devel-linux-x86_64
@@ -79,13 +79,13 @@ jobs:
           if-no-files-found: error
 
       - name: Generate viewer attestation
-        if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' }}
         uses: actions/attest@v1
         with:
           subject-path: ${{ github.workspace }}/open3d-viewer-*-Linux.deb
 
       - name: Upload viewer to GitHub artifacts
-        if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
+        if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' }}
         uses: actions/upload-artifact@v4
         with:
           name: open3d-viewer-Linux

From 75ad593d6eaab88565592361c13e927385aa2991 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 15 Jun 2026 23:11:30 +0000
Subject: [PATCH 6/9] Avoid hardcoded paths in windows.yml by defining and
 using env.INSTALL_DIR and Join-Path

---
 .github/workflows/windows.yml | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 1a1d5be5846..73b9944d541 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -31,6 +31,7 @@ env:
   CUDA_VERSION: "12.6.0"
   SRC_DIR: "D:\\a\\open3d\\open3d"
   BUILD_DIR: "C:\\Open3D\\build"
+  INSTALL_DIR: "C:\\Program Files\\Open3D"
   NPROC: 6
   DEVELOPER_BUILD: ${{ github.event.inputs.developer_build || 'ON' }}
 
@@ -138,7 +139,7 @@ jobs:
           cmake -G "Visual Studio 17 2022" -A x64 `
             -DDEVELOPER_BUILD=$Env:DEVELOPER_BUILD `
             -DBUILD_EXAMPLES=OFF `
-            -DCMAKE_INSTALL_PREFIX="C:\Program Files\Open3D" `
+            -DCMAKE_INSTALL_PREFIX="$env:INSTALL_DIR" `
             -DBUILD_SHARED_LIBS=${{ matrix.BUILD_SHARED_LIBS }} `
             -DSTATIC_WINDOWS_RUNTIME=${{ matrix.STATIC_RUNTIME }} `
             -DBUILD_COMMON_ISPC_ISAS=ON `
@@ -205,8 +206,10 @@ jobs:
             --target Open3DViewer
           cmake --build . --parallel ${{ env.NPROC }} --config ${{ matrix.CONFIG }} `
             --target INSTALL
-          $Env:OPEN3D_VERSION_FULL = (Select-String -Path "C:/Open3D/build/CMakeCache.txt" -Pattern "OPEN3D_VERSION_FULL").Line.Split('=')[1]
-          Compress-Archive -Path "C:/Program Files/Open3D/bin/Open3D" -DestinationPath `
+          $cmakeCachePath = Join-Path $env:BUILD_DIR "CMakeCache.txt"
+          $Env:OPEN3D_VERSION_FULL = (Select-String -Path $cmakeCachePath -Pattern "OPEN3D_VERSION_FULL").Line.Split('=')[1]
+          $open3dAppPath = Join-Path $env:INSTALL_DIR "bin\Open3D"
+          Compress-Archive -Path $open3dAppPath -DestinationPath `
             "$Env:GITHUB_WORKSPACE/open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip"
           echo "VIEWER_ZIP_NAME=open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip" | Out-File -FilePath `
             $Env:GITHUB_ENV -Encoding utf8 -Append
@@ -222,7 +225,7 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: open3d-app-windows-amd64
-          path: C:\Program Files\Open3D\bin\Open3D
+          path: ${{ env.INSTALL_DIR }}/bin/Open3D
           if-no-files-found: error
 
       - name: Update devel release with viewer
@@ -245,14 +248,14 @@ jobs:
           mkdir build
           cd build
           cmake -G "Visual Studio 17 2022" -A x64 `
-            -DCMAKE_INSTALL_PREFIX="C:\Program Files\Open3D" `
+            -DCMAKE_INSTALL_PREFIX="$env:INSTALL_DIR" `
             -DSTATIC_WINDOWS_RUNTIME=${{ matrix.STATIC_RUNTIME }} `
             ..
           cmake --build . --config ${{ matrix.CONFIG }}
           if ( '${{ matrix.BUILD_CUDA_MODULE }}' -eq 'OFF' ) {    # FIXME
             .\${{ matrix.CONFIG }}\Draw.exe --skip-for-unit-test
           }
-          Remove-Item "C:\Program Files\Open3D" -Recurse
+          Remove-Item $env:INSTALL_DIR -Recurse
       - name: Install Open3D python build requirements
         working-directory: ${{ env.SOURCE_DIR }}
         run: |
@@ -349,7 +352,7 @@ jobs:
             $Env:DEVELOPER_BUILD = "ON"
           }
           cmake -G "Visual Studio 17 2022" -A x64 `
-            -DCMAKE_INSTALL_PREFIX="C:\Program Files\Open3D" `
+            -DCMAKE_INSTALL_PREFIX="$env:INSTALL_DIR" `
             -DDEVELOPER_BUILD="$Env:DEVELOPER_BUILD" `
             -DBUILD_SHARED_LIBS=OFF `
             -DSTATIC_WINDOWS_RUNTIME=ON `

From 6f434236d92dabc8a12faf157f4fd653cde1d262 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 15 Jun 2026 23:12:35 +0000
Subject: [PATCH 7/9] Improve path separator consistency by using forward
 slashes for env.INSTALL_DIR and paths

---
 .github/workflows/windows.yml | 4 ++--
 workflow_fixes_plan.md        | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 73b9944d541..e13edd69e4d 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -31,7 +31,7 @@ env:
   CUDA_VERSION: "12.6.0"
   SRC_DIR: "D:\\a\\open3d\\open3d"
   BUILD_DIR: "C:\\Open3D\\build"
-  INSTALL_DIR: "C:\\Program Files\\Open3D"
+  INSTALL_DIR: "C:/Program Files/Open3D"
   NPROC: 6
   DEVELOPER_BUILD: ${{ github.event.inputs.developer_build || 'ON' }}
 
@@ -208,7 +208,7 @@ jobs:
             --target INSTALL
           $cmakeCachePath = Join-Path $env:BUILD_DIR "CMakeCache.txt"
           $Env:OPEN3D_VERSION_FULL = (Select-String -Path $cmakeCachePath -Pattern "OPEN3D_VERSION_FULL").Line.Split('=')[1]
-          $open3dAppPath = Join-Path $env:INSTALL_DIR "bin\Open3D"
+          $open3dAppPath = Join-Path $env:INSTALL_DIR "bin/Open3D"
           Compress-Archive -Path $open3dAppPath -DestinationPath `
             "$Env:GITHUB_WORKSPACE/open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip"
           echo "VIEWER_ZIP_NAME=open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip" | Out-File -FilePath `
diff --git a/workflow_fixes_plan.md b/workflow_fixes_plan.md
index a0a232c8fd9..ae665c51eaa 100644
--- a/workflow_fixes_plan.md
+++ b/workflow_fixes_plan.md
@@ -13,10 +13,10 @@ Address Copilot workflow reviews for `ubuntu.yml` and `windows.yml` to make them
 
 ## Implementation Steps
 - [x] Create `workflow_fixes_plan.md` to document research and decisions.
-- [ ] Modify `.github/workflows/ubuntu.yml` to replace `env.BUILD_SHARED_LIBS` with `matrix.BUILD_SHARED_LIBS` in `if:` expressions of the attestation/upload steps.
-- [ ] Modify `.github/workflows/windows.yml` to define `INSTALL_DIR: "C:\\Program Files\\Open3D"` in the workflow environment.
-- [ ] Replace hard-coded `"C:/Open3D/build/CMakeCache.txt"` in `windows.yml` with a path joined dynamically via `Join-Path`.
-- [ ] Replace hard-coded `"C:/Program Files/Open3D"` references with the `INSTALL_DIR` environment variable.
+- [x] Modify `.github/workflows/ubuntu.yml` to replace `env.BUILD_SHARED_LIBS` with `matrix.BUILD_SHARED_LIBS` in `if:` expressions of the attestation/upload steps.
+- [x] Modify `.github/workflows/windows.yml` to define `INSTALL_DIR: "C:\\Program Files\\Open3D"` in the workflow environment.
+- [x] Replace hard-coded `"C:/Open3D/build/CMakeCache.txt"` in `windows.yml` with a path joined dynamically via `Join-Path`.
+- [x] Replace hard-coded `"C:/Program Files/Open3D"` references with the `INSTALL_DIR` environment variable.
 - [ ] Run validation.
 
 ## Test Method

From 28b71cfe13853d2ee609541ff0cfb30f07894c1f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 15 Jun 2026 23:13:22 +0000
Subject: [PATCH 8/9] Restore backslashes in INSTALL_DIR for consistency with
 BUILD_DIR

---
 .github/workflows/windows.yml | 4 ++--
 workflow_fixes_plan.md        | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index e13edd69e4d..73b9944d541 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -31,7 +31,7 @@ env:
   CUDA_VERSION: "12.6.0"
   SRC_DIR: "D:\\a\\open3d\\open3d"
   BUILD_DIR: "C:\\Open3D\\build"
-  INSTALL_DIR: "C:/Program Files/Open3D"
+  INSTALL_DIR: "C:\\Program Files\\Open3D"
   NPROC: 6
   DEVELOPER_BUILD: ${{ github.event.inputs.developer_build || 'ON' }}
 
@@ -208,7 +208,7 @@ jobs:
             --target INSTALL
           $cmakeCachePath = Join-Path $env:BUILD_DIR "CMakeCache.txt"
           $Env:OPEN3D_VERSION_FULL = (Select-String -Path $cmakeCachePath -Pattern "OPEN3D_VERSION_FULL").Line.Split('=')[1]
-          $open3dAppPath = Join-Path $env:INSTALL_DIR "bin/Open3D"
+          $open3dAppPath = Join-Path $env:INSTALL_DIR "bin\Open3D"
           Compress-Archive -Path $open3dAppPath -DestinationPath `
             "$Env:GITHUB_WORKSPACE/open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip"
           echo "VIEWER_ZIP_NAME=open3d-$Env:OPEN3D_VERSION_FULL-app-windows-amd64.zip" | Out-File -FilePath `
diff --git a/workflow_fixes_plan.md b/workflow_fixes_plan.md
index ae665c51eaa..a96196d5451 100644
--- a/workflow_fixes_plan.md
+++ b/workflow_fixes_plan.md
@@ -17,7 +17,7 @@ Address Copilot workflow reviews for `ubuntu.yml` and `windows.yml` to make them
 - [x] Modify `.github/workflows/windows.yml` to define `INSTALL_DIR: "C:\\Program Files\\Open3D"` in the workflow environment.
 - [x] Replace hard-coded `"C:/Open3D/build/CMakeCache.txt"` in `windows.yml` with a path joined dynamically via `Join-Path`.
 - [x] Replace hard-coded `"C:/Program Files/Open3D"` references with the `INSTALL_DIR` environment variable.
-- [ ] Run validation.
+- [x] Run validation.
 
 ## Test Method
 Since we are only modifying CI/CD workflows and cannot run GitHub Actions locally, we will:

From cc40859567b358c0ed7383c04b7c79c8ea45a880 Mon Sep 17 00:00:00 2001
From: Sameer Sheorey <sameer.sheorey@intel.com>
Date: Mon, 15 Jun 2026 22:01:35 -0700
Subject: [PATCH 9/9] Fix errors, add docs.

---
 .github/workflows/documentation.yml   |  3 ++-
 .github/workflows/macos.yml           |  8 +++++---
 .github/workflows/ubuntu-cuda.yml     |  3 ++-
 .github/workflows/ubuntu-openblas.yml |  3 ++-
 .github/workflows/ubuntu-sycl.yml     |  3 ++-
 .github/workflows/ubuntu-wheel.yml    |  3 ++-
 .github/workflows/ubuntu.yml          |  5 +++--
 .github/workflows/windows.yml         | 14 +++++++------
 README.md                             |  7 +++++++
 docs/getting_started.in.rst           | 23 +++++++++++++++++++++
 workflow_fixes_plan.md                | 29 ---------------------------
 11 files changed, 56 insertions(+), 45 deletions(-)
 delete mode 100644 workflow_fixes_plan.md

diff --git a/.github/workflows/documentation.yml b/.github/workflows/documentation.yml
index 78077c66f96..8e642b5054f 100644
--- a/.github/workflows/documentation.yml
+++ b/.github/workflows/documentation.yml
@@ -24,6 +24,7 @@ jobs:
       contents: write  # Artifact upload and release upload
       id-token: write
       attestations: write
+      artifact-metadata: write
     runs-on: ubuntu-latest
     env:
       DEVELOPER_BUILD: ${{ github.event.inputs.developer_build || 'ON' }}
@@ -52,7 +53,7 @@ jobs:
           mv open3d-*-docs.tar.gz open3d-${GITHUB_SHA}-docs.tar.gz
 
       - name: Generate docs attestation
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: ${{ github.workspace }}/open3d-${{ github.sha }}-docs.tar.gz
 
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index b78e00c7282..495049bbb35 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -31,6 +31,7 @@ jobs:
       contents: write  # upload
       id-token: write
       attestations: write
+      artifact-metadata: write
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -90,7 +91,7 @@ jobs:
 
       - name: Generate package attestation
         if: ${{ env.BUILD_SHARED_LIBS == 'ON' }}
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: build/package/${{ env.DEVEL_PKG_NAME }}
 
@@ -104,7 +105,7 @@ jobs:
 
       - name: Generate viewer attestation
         if: ${{ env.BUILD_SHARED_LIBS == 'OFF' }}
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: build/bin/open3d-*-app-macosx-10_15-${{ runner.arch }}.zip
 
@@ -133,6 +134,7 @@ jobs:
       contents: write  # upload
       id-token: write
       attestations: write
+      artifact-metadata: write
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -216,7 +218,7 @@ jobs:
           echo "PIP_PKG_NAME=$PIP_PKG_NAME" >> $GITHUB_ENV
 
       - name: Generate wheel attestation
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: build/lib/python_package/pip_package/${{ env.PIP_PKG_NAME }}
 
diff --git a/.github/workflows/ubuntu-cuda.yml b/.github/workflows/ubuntu-cuda.yml
index 39529db7879..b69b747155f 100644
--- a/.github/workflows/ubuntu-cuda.yml
+++ b/.github/workflows/ubuntu-cuda.yml
@@ -49,6 +49,7 @@ jobs:
       contents: write   # upload
       id-token: write
       attestations: write
+      artifact-metadata: write
     runs-on: ubuntu-latest
     needs: [skip-check]
     if: needs.skip-check.outputs.skip == 'no'
@@ -155,7 +156,7 @@ jobs:
 
       - name: Generate package attestation
         if: ${{ env.BUILD_PACKAGE == 'true' }}
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: ${{ github.workspace }}/open3d-devel-linux*.tar.xz
 
diff --git a/.github/workflows/ubuntu-openblas.yml b/.github/workflows/ubuntu-openblas.yml
index f60492d7b2a..46ad4b5a1ff 100644
--- a/.github/workflows/ubuntu-openblas.yml
+++ b/.github/workflows/ubuntu-openblas.yml
@@ -39,6 +39,7 @@ jobs:
       contents: write  # Release upload
       id-token: write
       attestations: write
+      artifact-metadata: write
     runs-on: ubuntu-24.04-arm   # latest
     strategy:
       fail-fast: false
@@ -86,7 +87,7 @@ jobs:
         run: docker/docker_test.sh "${DOCKER_TAG}"
 
       - name: Generate wheel attestation
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: ${{ github.workspace }}/${{ env.PIP_PKG_NAME }}
 
diff --git a/.github/workflows/ubuntu-sycl.yml b/.github/workflows/ubuntu-sycl.yml
index 0d911bca7ba..e4903de1890 100644
--- a/.github/workflows/ubuntu-sycl.yml
+++ b/.github/workflows/ubuntu-sycl.yml
@@ -28,6 +28,7 @@ jobs:
       contents: write  # Release upload
       id-token: write
       attestations: write
+      artifact-metadata: write
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -58,7 +59,7 @@ jobs:
 
       - name: Generate artifact attestation
         if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' }}
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: |
             ${{ github.workspace }}/open3d*.whl
diff --git a/.github/workflows/ubuntu-wheel.yml b/.github/workflows/ubuntu-wheel.yml
index 79093c0454e..1b16e1ec168 100644
--- a/.github/workflows/ubuntu-wheel.yml
+++ b/.github/workflows/ubuntu-wheel.yml
@@ -28,6 +28,7 @@ jobs:
       contents: write  # Release upload
       id-token: write
       attestations: write
+      artifact-metadata: write
     name: Build wheel
     runs-on: ubuntu-latest
     strategy:
@@ -91,7 +92,7 @@ jobs:
           echo "PIP_PKG_NAME=$PIP_PKG_NAME" >> $GITHUB_ENV
           echo "PIP_CPU_PKG_NAME=$PIP_CPU_PKG_NAME" >> $GITHUB_ENV
       - name: Generate artifact attestation
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: |
             ${{ github.workspace }}/${{ env.PIP_PKG_NAME }}
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
index 92663869bae..c942d18f3d5 100644
--- a/.github/workflows/ubuntu.yml
+++ b/.github/workflows/ubuntu.yml
@@ -24,6 +24,7 @@ jobs:
       contents: write  # Release upload
       id-token: write
       attestations: write
+      artifact-metadata: write
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -66,7 +67,7 @@ jobs:
           fi
       - name: Generate package attestation
         if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' }}
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: ${{ github.workspace }}/open3d-devel-*.tar.xz
 
@@ -80,7 +81,7 @@ jobs:
 
       - name: Generate viewer attestation
         if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' }}
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: ${{ github.workspace }}/open3d-viewer-*-Linux.deb
 
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 73b9944d541..bd24116faa2 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -41,6 +41,7 @@ jobs:
       contents: write  # upload
       id-token: write
       attestations: write
+      artifact-metadata: write
     runs-on: windows-2022
     strategy:
       fail-fast: false
@@ -176,7 +177,7 @@ jobs:
 
       - name: Generate package attestation
         if: ${{ matrix.BUILD_SHARED_LIBS == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' }}
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: ${{ env.BUILD_DIR }}/package/${{ env.DEVEL_PKG_NAME }}
 
@@ -216,7 +217,7 @@ jobs:
 
       - name: Generate viewer attestation
         if: ${{ matrix.BUILD_SHARED_LIBS == 'OFF' && matrix.STATIC_RUNTIME == 'ON' && matrix.BUILD_CUDA_MODULE == 'OFF' && matrix.CONFIG == 'Release' }}
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: ${{ github.workspace }}/${{ env.VIEWER_ZIP_NAME }}
 
@@ -225,7 +226,7 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: open3d-app-windows-amd64
-          path: ${{ env.INSTALL_DIR }}/bin/Open3D
+          path: ${{ github.workspace }}/${{ env.VIEWER_ZIP_NAME }}
           if-no-files-found: error
 
       - name: Update devel release with viewer
@@ -255,9 +256,9 @@ jobs:
           if ( '${{ matrix.BUILD_CUDA_MODULE }}' -eq 'OFF' ) {    # FIXME
             .\${{ matrix.CONFIG }}\Draw.exe --skip-for-unit-test
           }
-          Remove-Item $env:INSTALL_DIR -Recurse
+          Remove-Item -LiteralPath $env:INSTALL_DIR -Recurse -Force -ErrorAction SilentlyContinue
       - name: Install Open3D python build requirements
-        working-directory: ${{ env.SOURCE_DIR }}
+        working-directory: ${{ env.SRC_DIR }}
         run: |
           $ErrorActionPreference = 'Stop'
           python -m pip install -U pip==${{ env.PIP_VER }}
@@ -282,6 +283,7 @@ jobs:
       contents: write  # upload
       id-token: write
       attestations: write
+      artifact-metadata: write
     runs-on: windows-2022
     strategy:
       fail-fast: false
@@ -373,7 +375,7 @@ jobs:
           echo "PIP_PKG_NAME=$PIP_PKG_NAME"  | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
 
       - name: Generate wheel attestation
-        uses: actions/attest@v1
+        uses: actions/attest@v4
         with:
           subject-path: ${{ env.BUILD_DIR }}/lib/python_package/pip_package/${{ env.PIP_PKG_NAME }}
 
diff --git a/README.md b/README.md
index ad9082e73f2..ecdce05a71e 100644
--- a/README.md
+++ b/README.md
@@ -91,6 +91,13 @@ To get the latest features in Open3D, install the
 To compile Open3D from source, refer to
 [compiling from source](https://www.open3d.org/docs/release/compilation.html).
 
+Release artifacts (Python wheels and C++ binaries) include signed
+[SLSA](https://slsa.dev) build-provenance attestations (GitHub Artifact
+Attestations), aligned with [OpenSSF](https://openssf.org) supply-chain
+guidance. See
+[Getting started — supply chain attestations](https://www.open3d.org/docs/latest/getting_started.html#supply-chain-attestations)
+for verification with the GitHub CLI.
+
 ## C++ quick start
 
 Checkout the following links to get started with Open3D C++ API
diff --git a/docs/getting_started.in.rst b/docs/getting_started.in.rst
index dab69dba54e..75d70782d09 100644
--- a/docs/getting_started.in.rst
+++ b/docs/getting_started.in.rst
@@ -20,6 +20,29 @@ version (``HEAD`` of ``main`` branch) viewer app is provided here [#]_:
 .. [#] Please use these links from the `latest version of this page <https://www.open3d.org/docs/latest/getting_started.html>`__ only.
 .. [#] To check the `glibc` version on your system, run :code:`ldd --version`.
 
+.. _supply_chain_attestations:
+
+Supply chain attestations
+=========================
+
+Development artifacts linked on this page—viewer packages, pip wheels, C++
+devel archives, and documentation tarballs—are produced by GitHub Actions with
+signed `SLSA build provenance <https://slsa.dev>`__ attestations (`GitHub
+Artifact Attestations
+<https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds>`__),
+consistent with `OpenSSF <https://openssf.org>`__ supply-chain recommendations.
+
+After saving a file locally, verify it with the `GitHub CLI
+<https://cli.github.com/>`__:
+
+.. code-block:: bash
+
+    gh attestation verify /path/to/<artifact> -R isl-org/Open3D
+
+Replace ``/path/to/<artifact>`` with the wheel, ``.deb``, ``.zip``, ``.tar.xz``,
+or docs ``.tar.gz`` you downloaded. A successful check confirms the file matches
+provenance recorded for this repository.
+
 Python
 ======
 
diff --git a/workflow_fixes_plan.md b/workflow_fixes_plan.md
deleted file mode 100644
index a96196d5451..00000000000
--- a/workflow_fixes_plan.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# Plan: Address Copilot Workflow Reviews
-
-## Goal
-Address Copilot workflow reviews for `ubuntu.yml` and `windows.yml` to make them more robust and maintainable.
-
-## Requirements
-1. **`ubuntu.yml`**:
-   - Use `matrix.BUILD_SHARED_LIBS` consistently in `if:` expressions instead of `env.BUILD_SHARED_LIBS` to ensure attestation and artifact steps execute correctly.
-2. **`windows.yml`**:
-   - Avoid hard-coded paths like `C:/Open3D/build/CMakeCache.txt` and `C:/Program Files/Open3D/...`.
-   - Track/define installation path as `INSTALL_DIR` at the workflow environment level.
-   - Construct `CMakeCache.txt` path and Open3D application binary path using `$env:BUILD_DIR`, `$env:INSTALL_DIR`, and PowerShell `Join-Path`.
-
-## Implementation Steps
-- [x] Create `workflow_fixes_plan.md` to document research and decisions.
-- [x] Modify `.github/workflows/ubuntu.yml` to replace `env.BUILD_SHARED_LIBS` with `matrix.BUILD_SHARED_LIBS` in `if:` expressions of the attestation/upload steps.
-- [x] Modify `.github/workflows/windows.yml` to define `INSTALL_DIR: "C:\\Program Files\\Open3D"` in the workflow environment.
-- [x] Replace hard-coded `"C:/Open3D/build/CMakeCache.txt"` in `windows.yml` with a path joined dynamically via `Join-Path`.
-- [x] Replace hard-coded `"C:/Program Files/Open3D"` references with the `INSTALL_DIR` environment variable.
-- [x] Run validation.
-
-## Test Method
-Since we are only modifying CI/CD workflows and cannot run GitHub Actions locally, we will:
-1. Verify syntax of the modified YAML files.
-2. Ensure that GHA syntax is correct.
-
-## Risks and Mitigations
-- **Risk**: Syntactical errors in GitHub Actions workflow YAML.
-- **Mitigation**: Double-check indentation, quotes, and GHA expression syntax before committing.