aboutsummaryrefslogtreecommitdiff
path: root/.github/workflows/publish-firefox-development.yml
diff options
context:
space:
mode:
authorDarius Jahandarie <djahandarie@gmail.com>2023-10-01 06:33:27 +0000
committerGitHub <noreply@github.com>2023-10-01 06:33:27 +0000
commit7243b3c48b935cf76534846cb74afa0921e1b796 (patch)
tree92b655ae9028e87445bb74899f6fd0b459185125 /.github/workflows/publish-firefox-development.yml
parentc7f7e84fe9109bedec8c7c531d3b6e48056dd3b3 (diff)
parent947f933f14311ecc22314e173275655cbe1e5ad9 (diff)
Merge pull request #262 from themoeway/add-provenance
Add SLSA provenance to releases
Diffstat (limited to '.github/workflows/publish-firefox-development.yml')
-rw-r--r--.github/workflows/publish-firefox-development.yml20
1 files changed, 19 insertions, 1 deletions
diff --git a/.github/workflows/publish-firefox-development.yml b/.github/workflows/publish-firefox-development.yml
index f704e365..cf386cef 100644
--- a/.github/workflows/publish-firefox-development.yml
+++ b/.github/workflows/publish-firefox-development.yml
@@ -12,11 +12,13 @@ on:
permissions:
contents: read
jobs:
- build-signed-xpi-asset:
+ build:
runs-on: ubuntu-latest
environment: cd
permissions:
contents: write
+ outputs:
+ hashes: ${{ steps.hash.outputs.hashes }}
steps:
- uses: robinraju/release-downloader@efa4cd07bd0195e6cc65e9e30c251b49ce4d3e51 # pin@v1.8
with:
@@ -41,6 +43,11 @@ jobs:
steps.ffSignXpi.outputs.sameVersionAlreadyUploadedError != 'true'
run: exit 1
+ - name: Generate hashes
+ id: hash
+ run: |
+ echo "hashes=$(sha256sum yomitan-firefox-dev.xpi | base64 -w0)" >> "$GITHUB_OUTPUT"
+
- name: Upload offline xpi release asset
id: uploadReleaseAsset
if: steps.ffSignXpi.outcome == 'success'
@@ -86,3 +93,14 @@ jobs:
uses: ad-m/github-push-action@29f05e01bb17e6f28228b47437e03a7b69e1f9ef # pin@master
with:
branch: metadata
+
+ provenance:
+ needs: [build]
+ permissions:
+ actions: read # To read the workflow path.
+ id-token: write # To sign the provenance.
+ contents: write # To add assets to a release.
+ uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@07e64b653f10a80b6510f4568f685f8b7b9ea830
+ with:
+ base64-subjects: "${{ needs.build.outputs.hashes }}"
+ upload-assets: true