Merge pull request #89 from thepwagner-org/github-attestations

attest-build-provenance

.github/workflows/golang-release-attest.yaml

@@ -0,0 +1,60 @@
+# Example repository: https://github.com/thepwagner/github-token-factory-oidc
+
+on:
+  workflow_call:
+    inputs:
+      docker:
+        required: false
+        type: boolean
+        description: Whether to build and push a Docker image
+        default: false
+      go-version-file:
+        required: false
+        type: string
+        description: Path to go.mod file
+        default: "go.mod"
+    secrets:
+      ghcr-token:
+        required: false
+        description: Token to use for GitHub container registry
+
+permissions: {}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # to attach artifacts to releases
+      id-token: write
+      attestations: write
+    steps:
+      - name: "🌎 Fetching code"
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+        with:
+          persist-credentials: false
+      - name: "🌎 Setup Go"
+        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
+        with:
+          go-version-file: ${{inputs.go-version-file}}
+      - name: "🐳 Logging in to Docker Registry"
+        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
+        if: ${{ inputs.docker }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.ghcr-token }}
+      - name: "📦 Release"
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
+        with:
+          version: v1.25.1
+          args: release --clean --parallelism=1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: "🔏 Sign .deb"
+        uses: actions/attest-build-provenance@897ed5eab6ed058a474202017ada7f40bfa52940 # v1.0.0
+        with:
+          subject-path: "dist/*.deb"
+      - name: "🔏 Sign .tar.gz"
+        uses: actions/attest-build-provenance@897ed5eab6ed058a474202017ada7f40bfa52940 # v1.0.0
+        with:
+          subject-path: "dist/*.tar.gz"

.github/workflows/golang-release.yaml

@@ -42,9 +42,9 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.ghcr-token }}
       - name: "📦 Release"
-        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # tag=v5.0.0
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
-          version: v1.22.1
+          version: v1.25.1
           args: release --clean --parallelism=1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}