diff options
| author | Darius Jahandarie <djahandarie@gmail.com> | 2023-10-01 06:33:27 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-10-01 06:33:27 +0000 |
| commit | 7243b3c48b935cf76534846cb74afa0921e1b796 (patch) | |
| tree | 92b655ae9028e87445bb74899f6fd0b459185125 /.github/workflows/publish-firefox-development.yml | |
| parent | c7f7e84fe9109bedec8c7c531d3b6e48056dd3b3 (diff) | |
| parent | 947f933f14311ecc22314e173275655cbe1e5ad9 (diff) | |
Merge pull request #262 from themoeway/add-provenance
Add SLSA provenance to releases
Diffstat (limited to '.github/workflows/publish-firefox-development.yml')
| -rw-r--r-- | .github/workflows/publish-firefox-development.yml | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/.github/workflows/publish-firefox-development.yml b/.github/workflows/publish-firefox-development.yml index f704e365..cf386cef 100644 --- a/.github/workflows/publish-firefox-development.yml +++ b/.github/workflows/publish-firefox-development.yml @@ -12,11 +12,13 @@ on: permissions: contents: read jobs: - build-signed-xpi-asset: + build: runs-on: ubuntu-latest environment: cd permissions: contents: write + outputs: + hashes: ${{ steps.hash.outputs.hashes }} steps: - uses: robinraju/release-downloader@efa4cd07bd0195e6cc65e9e30c251b49ce4d3e51 # pin@v1.8 with: @@ -41,6 +43,11 @@ jobs: steps.ffSignXpi.outputs.sameVersionAlreadyUploadedError != 'true' run: exit 1 + - name: Generate hashes + id: hash + run: | + echo "hashes=$(sha256sum yomitan-firefox-dev.xpi | base64 -w0)" >> "$GITHUB_OUTPUT" + - name: Upload offline xpi release asset id: uploadReleaseAsset if: steps.ffSignXpi.outcome == 'success' @@ -86,3 +93,14 @@ jobs: uses: ad-m/github-push-action@29f05e01bb17e6f28228b47437e03a7b69e1f9ef # pin@master with: branch: metadata + + provenance: + needs: [build] + permissions: + actions: read # To read the workflow path. + id-token: write # To sign the provenance. + contents: write # To add assets to a release. + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@07e64b653f10a80b6510f4568f685f8b7b9ea830 + with: + base64-subjects: "${{ needs.build.outputs.hashes }}" + upload-assets: true |