generate artifact attestations

sarisia · May 3, 2024 · 1dae4b4 · 1dae4b4
1 parent 9e29ab9
commit 1dae4b4
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -11,6 +11,9 @@ jobs:
     permissions:
       contents: write
       packages: read
+      id-token: write
+      attestations: write
+
     steps:
       - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b
 
@@ -30,6 +33,16 @@ jobs:
             npm ci
             npm run build
 
+      - name: generate artifact attestation for action.yml
+        uses: actions/attest-build-provenance@897ed5eab6ed058a474202017ada7f40bfa52940
+        with:
+          subject-path: action.yml
+
+      - name: generate artifact attestation for lib/index.js
+        uses: actions/attest-build-provenance@897ed5eab6ed058a474202017ada7f40bfa52940
+        with:
+          subject-path: lib/index.js
+
       - name: Build and Tag
         # temporary use own fork until
         # uses: JasonEtco/build-and-tag-action@v2