action.yml

name: 'Generate Build Provenance'
description: 'Generate provenance attestations for build artifacts'
author: 'GitHub'

inputs:
  github-token:
    description: >
      The GitHub token used to make authenticated API requests.
    default: ${{ github.token }}
    required: false
  subject-path:
    description: >
      Path to the artifact for which provenance will be generated. Must specify
      exactly one of "subject-path" or "subject-digest".
    required: false
  subject-digest:
    description: >
      Digest of the subject for which provenance will be generated. Must be in
      the form "algorithm:hex_digest" (e.g. "sha256:abc123..."). Must specify
      exactly one of "subject-path" or "subject-digest".
    required: false
  subject-name:
    description: >
      Subject name as it should appear in the provenance statement. Required
      unless "subject-path" is specified, in which case it will be inferred from
      the path.
  push-to-registry:
    description: >
      Whether to push the provenance statement to the image registry. Requires
      that the "subject-name" parameter specify the fully-qualified image name
      and that the "subject-digest" parameter be specified. Defaults to false.
    default: false
    required: false

outputs:
  bundle:
    description: >
      The JSON-serialized Sigstore bundle containing the signed provenance
      statement and related verification material.
    value: ${{ steps.translate-output.outputs.bundle }}

runs:
  using: 'composite'
  steps:
    - uses: actions/attest-build-provenance@v1
      id: attest
      with:
        subject-path: ${{ inputs.subject-path }}
        subject-digest: ${{ inputs.subject-digest }}
        subject-name: ${{ inputs.subject-name }}
        push-to-registry: ${{ inputs.push-to-registry }}
        github-token: ${{ inputs.github-token }}
    - id: translate-output
      if: runner.os != 'Windows'
      shell: bash
      run: |
        read -r line < ${{ steps.attest.outputs.bundle-path }}
        echo "bundle=$line" >> $GITHUB_OUTPUT
    - id: upgrade-notice
      shell: bash
      run: |
        echo "### Deprecation Notice" >> $GITHUB_STEP_SUMMARY
        echo "Please migrate from \`github-early-access/generate-build-provenance\` to \`actions/attest-build-provenance\`" >> $GITHUB_STEP_SUMMARY