Skip to content

Commit 6a9fb83

Browse files
committed
Generate artifact attestation
1 parent ef8f3c4 commit 6a9fb83

File tree

5 files changed

+44
-3
lines changed

5 files changed

+44
-3
lines changed

.github/workflows/build-linux.yml

+10
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ jobs:
1010

1111
runs-on: ubuntu-latest
1212

13+
permissions:
14+
attestations: write
15+
id-token: write
16+
1317
strategy:
1418
fail-fast: false
1519
matrix:
@@ -127,6 +131,12 @@ jobs:
127131
dart run grinder pkg-standalone-${{ matrix.target }}
128132
EOF
129133
134+
- name: Generate artifact attestation
135+
if: github.ref_type == 'tag'
136+
uses: actions/attest-build-provenance@v2
137+
with:
138+
subject-path: build/*.tar.gz
139+
130140
- name: Upload Artifact
131141
uses: actions/upload-artifact@v4
132142
with:

.github/workflows/build-macos.yml

+10
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ jobs:
1010

1111
runs-on: ${{ matrix.runner }}
1212

13+
permissions:
14+
attestations: write
15+
id-token: write
16+
1317
strategy:
1418
fail-fast: false
1519
matrix:
@@ -28,6 +32,12 @@ jobs:
2832
- name: Build
2933
run: dart run grinder pkg-standalone-macos-${{ matrix.arch }}
3034

35+
- name: Generate artifact attestation
36+
if: github.ref_type == 'tag'
37+
uses: actions/attest-build-provenance@v2
38+
with:
39+
subject-path: build/*.tar.gz
40+
3141
- name: Upload Artifact
3242
uses: actions/upload-artifact@v4
3343
with:

.github/workflows/build-windows.yml

+10
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ jobs:
1010

1111
runs-on: ${{ matrix.runner }}
1212

13+
permissions:
14+
attestations: write
15+
id-token: write
16+
1317
strategy:
1418
fail-fast: false
1519
matrix:
@@ -30,6 +34,12 @@ jobs:
3034
- name: Build
3135
run: dart run grinder pkg-standalone-windows-${{ matrix.arch }}
3236

37+
- name: Generate artifact attestation
38+
if: github.ref_type == 'tag'
39+
uses: actions/attest-build-provenance@v2
40+
with:
41+
subject-path: build/*.zip
42+
3343
- name: Upload Artifact
3444
uses: actions/upload-artifact@v4
3545
with:

.github/workflows/ci.yml

+5-3
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
name: Double-check
1616
runs-on: ubuntu-latest
1717
needs: [test]
18-
if: "startsWith(github.ref, 'refs/tags/') && github.event.repository.fork == false"
18+
if: "github.ref_type == 'tag' && github.event.repository.fork == false"
1919

2020
steps:
2121
- uses: actions/checkout@v4
@@ -27,14 +27,16 @@ jobs:
2727

2828
test_vendor:
2929
needs: [double_check]
30-
if: "startsWith(github.ref, 'refs/tags/') && github.event.repository.fork == false"
30+
if: "github.ref_type == 'tag' && github.event.repository.fork == false"
3131
uses: ./.github/workflows/test-vendor.yml
3232
secrets: inherit
3333

3434
release:
3535
needs: [test_vendor]
36-
if: "startsWith(github.ref, 'refs/tags/') && github.event.repository.fork == false"
36+
if: "github.ref_type == 'tag' && github.event.repository.fork == false"
3737
permissions:
38+
attestations: write
3839
contents: write
40+
id-token: write
3941
uses: ./.github/workflows/release.yml
4042
secrets: inherit

.github/workflows/release.yml

+9
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,23 @@ on:
55

66
jobs:
77
build_linux:
8+
permissions:
9+
attestations: write
10+
id-token: write
811
uses: ./.github/workflows/build-linux.yml
912
secrets: inherit
1013

1114
build_macos:
15+
permissions:
16+
attestations: write
17+
id-token: write
1218
uses: ./.github/workflows/build-macos.yml
1319
secrets: inherit
1420

1521
build_windows:
22+
permissions:
23+
attestations: write
24+
id-token: write
1625
uses: ./.github/workflows/build-windows.yml
1726
secrets: inherit
1827

0 commit comments

Comments
 (0)