Generate GitHub Artifact Attestations

suzuki-shunsuke · SamMorrowDrums · commit 923e1b065d71 · 2025-04-08T10:06:35.000+02:00
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
@@ -5,6 +5,8 @@ on:
       - "v*"
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 jobs:
   release:
@@ -33,3 +35,11 @@ jobs:
           workdir: .
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate signed build provenance attestations for workflow artifacts
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: |
+            dist/*.tar.gz
+            dist/*.zip
+            dist/*.txt
