Skip to content

ci: attest build provenance for release artifacts #14864

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mab879 merged 1 commit into from
Jul 9, 2026
+12 −0
Merged

ci: attest build provenance for release artifacts #14864

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,11 @@
name: Release
on:
push:
tags: [ 'v*.*.*' ]

Check failure on line 4 in .github/workflows/release.yaml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

4:21 [brackets] too many spaces inside brackets

Check failure on line 4 in .github/workflows/release.yaml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

4:12 [brackets] too many spaces inside brackets
permissions:
contents: write
id-token: write
attestations: write
jobs:
release-fedora:
name: Release on Fedora Latest (Container)
Expand Down Expand Up @@ -32,6 +34,16 @@
- name: Build Package Source
run: make -j$(nproc) package_source
working-directory: ./build
- name: Attest build provenance
uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4
with:
subject-path: |
build/scap-security-guide-*.tar.bz2
build/scap-security-guide-*.tar.bz2.sha512
build/zipfile/scap-security-guide-*.zip
build/zipfile/scap-security-guide-*.zip.sha512
build/zipfile/scap-security-guide-*.tar.gz
build/zipfile/scap-security-guide-*.tar.gz.sha512
- name: Set Version
id: set_version
run: |-
Expand All @@ -45,7 +57,7 @@
with:
configuration: .github/workflows/release-changelog.json
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Check failure on line 60 in .github/workflows/release.yaml

View workflow job for this annotation

GitHub Actions / Yaml Lint on Changed yaml files 

60:10 [indentation] wrong indentation: expected 10 but found 9
- name: Release
uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
with:
Expand Down
Loading