-
Notifications
You must be signed in to change notification settings - Fork 0
47 lines (39 loc) · 1.15 KB
/
provenance.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
name: Publish
permissions:
contents: write
on:
push:
tags:
- v[0-9]+.*
jobs:
build:
runs-on: ubuntu-latest
outputs:
hashes: ${{ steps.hash.outputs.hashes }}
steps:
- name: Checkout repository
uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3
- name: Build using cargo
run: |
cargo build --release
cp target/release/tuf-keyid .
- name: Generate subject
id: hash
run: |
set -euo pipefail
echo "hashes=$(sha256sum tuf-keyid | base64 -w0)" >> "$GITHUB_OUTPUT"
- name: Upload tuf-keyid
uses: actions/upload-artifact@v2
with:
name: tuf-keyid
path: ./tuf-keyid
provenance:
needs: [build]
permissions:
actions: read # To read the workflow path.
id-token: write # To sign the provenance.
contents: write # To add assets to a release.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0
with:
base64-subjects: "${{ needs.build.outputs.hashes }}"
upload-assets: true # Optional: Upload to a new release