ci: slsa publish fix attempt

This commit is contained in:
Mark Joshwel 2023-06-03 11:14:45 +00:00 committed by GitHub
parent aba11aee95
commit 3017a17510
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -1,4 +1,4 @@
name: slsa publish name: publish (slsa 3)
on: on:
workflow_dispatch: workflow_dispatch:
release: release:
@ -8,22 +8,28 @@ jobs:
build: build:
runs-on: ubuntu-latest runs-on: ubuntu-latest
outputs: outputs:
digests: ${{ steps.hash.outputs.digests }} hashes: ${{ steps.hash.outputs.hashes }}
steps: steps:
- uses: actions/checkout@v3 - name: checkout
uses: actions/checkout@v3
- name: install devbox - name: install devbox
uses: jetpack-io/devbox-install-action@v0.3.0 uses: jetpack-io/devbox-install-action@v0.3.0
- name: build artifacts
run: | - name: install dependencies
devbox run poetry install run: devbox run poetry install
devbox run poetry build
- name: hash artifacts - name: install dependencies
id: build
run: devbox run poetry build
- name: generate provenance subjects
id: hash id: hash
run: | run: |
set -euo pipefail cd dist
files=$(ls dist/*.whl) HASHES=$(sha256sum * | base64 -w0)
echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" echo "hashes=$HASHES" >> "$GITHUB_OUTPUT"
provenance: provenance:
needs: [build] needs: [build]
@ -31,7 +37,7 @@ jobs:
actions: read actions: read
id-token: write id-token: write
contents: write contents: write
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0 uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.6.0
with: with:
base64-subjects: "${{ needs.build.outputs.digests }}" base64-subjects: "${{ needs.build.outputs.hashes }}"
upload-assets: true upload-assets: true