diff options
Diffstat (limited to '.github/workflows/publish-firefox-development.yml')
| -rw-r--r-- | .github/workflows/publish-firefox-development.yml | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/.github/workflows/publish-firefox-development.yml b/.github/workflows/publish-firefox-development.yml index f704e365..32b0532a 100644 --- a/.github/workflows/publish-firefox-development.yml +++ b/.github/workflows/publish-firefox-development.yml @@ -12,11 +12,13 @@ on: permissions: contents: read jobs: - build-signed-xpi-asset: + build: runs-on: ubuntu-latest environment: cd permissions: contents: write + outputs: + hashes: ${{ steps.hash.outputs.hashes }} steps: - uses: robinraju/release-downloader@efa4cd07bd0195e6cc65e9e30c251b49ce4d3e51 # pin@v1.8 with: @@ -41,6 +43,11 @@ jobs: steps.ffSignXpi.outputs.sameVersionAlreadyUploadedError != 'true' run: exit 1 + - name: Generate hashes + id: hash + run: | + echo "hashes=$(sha256sum yomitan-firefox-dev.xpi | base64 -w0)" >> "$GITHUB_OUTPUT" + - name: Upload offline xpi release asset id: uploadReleaseAsset if: steps.ffSignXpi.outcome == 'success' @@ -86,3 +93,14 @@ jobs: uses: ad-m/github-push-action@29f05e01bb17e6f28228b47437e03a7b69e1f9ef # pin@master with: branch: metadata + + provenance: + needs: [build] + permissions: + actions: read # To read the workflow path. + id-token: write # To sign the provenance. + contents: write # To add assets to a release. + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + with: + base64-subjects: "${{ needs.build.outputs.hashes }}" + upload-assets: true |