64 lines
2.1 KiB
YAML
64 lines
2.1 KiB
YAML
# This workflow uses actions that are not certified by GitHub.
|
|
# They are provided by a third-party and are governed by
|
|
# separate terms of service, privacy policy, and support
|
|
# documentation.
|
|
|
|
# This workflow lets you compile your Go project using a SLSA3 compliant builder.
|
|
# This workflow will generate a so-called "provenance" file describing the steps
|
|
# that were performed to generate the final binary.
|
|
# The project is an initiative of the OpenSSF (openssf.org) and is developed at
|
|
# https://github.com/slsa-framework/slsa-github-generator.
|
|
# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
|
|
# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.
|
|
|
|
name: SLSA generic generator
|
|
on:
|
|
workflow_dispatch:
|
|
release:
|
|
types: [created]
|
|
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
build:
|
|
outputs:
|
|
digests: ${{ steps.hash.outputs.digests }}
|
|
|
|
steps:
|
|
# ========================================================
|
|
#
|
|
# Step 1: Build your artifacts.
|
|
#
|
|
# ========================================================
|
|
- name: Build artifacts
|
|
run: |
|
|
# These are some amazing artifacts.
|
|
echo "artifact1" > artifact1
|
|
echo "artifact2" > artifact2
|
|
|
|
# ========================================================
|
|
#
|
|
# Step 2: Add a step to generate the provenance subjects
|
|
# as shown below. Update the sha256 sum arguments
|
|
# to include all binaries that you generate
|
|
# provenance for.
|
|
#
|
|
# ========================================================
|
|
- name: Generate subject
|
|
id: hash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
echo "::set-output name=digests::$(sha256sum artifact1 artifact2 | base64 -w0)"
|
|
|
|
provenance:
|
|
needs: [build]
|
|
permissions:
|
|
actions: read
|
|
id-token: write
|
|
contents: read
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.2.0
|
|
with:
|
|
base64-subjects: "${{ needs.build.outputs.digests }}"
|
|
upload-assets: true # Optional: Upload to a new release
|