surplus/.github/workflows/publish-slsa3.yml

56 lines
1.2 KiB
YAML

name: release with slsa 3 compliance
on:
push:
branches:
main
tags:
- '*'
jobs:
build:
runs-on: ubuntu-latest
permissions:
contents: write
outputs:
hashes: ${{ steps.hash.outputs.hashes }}
steps:
- name: checkout
uses: actions/checkout@v3
- name: install devbox
uses: jetpack-io/devbox-install-action@v0.3.0
- name: install dependencies
run: devbox run poetry install
- name: install dependencies
id: build
run: devbox run poetry build
- name: generate provenance subjects
id: hash
run: |
cd dist
HASHES=$(sha256sum * | base64 -w0)
echo "hashes=$HASHES" >> "$GITHUB_OUTPUT"
- name: release
uses: softprops/action-gh-release@v0.1.15
if: startsWith(github.ref, 'refs/tags/')
with:
files: |
dist/*.whl
provenance:
needs: [build]
permissions:
actions: read
id-token: write
contents: write
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.6.0
with:
base64-subjects: "${{ needs.build.outputs.hashes }}"
upload-assets: true