49
49
fail-fast : false
50
50
matrix :
51
51
include : ${{ fromJSON(needs.path-filter.outputs.package-matrix) }}
52
+ outputs :
53
+ hashes : ${{ steps.hashes.outputs }}
52
54
steps :
53
55
- uses : actions/checkout@v4
54
56
with :
@@ -67,23 +69,41 @@ jobs:
67
69
rye sync
68
70
rye build
69
71
- name : " Generate hashes"
70
- id : hash
72
+ id : hashes
71
73
run : |
72
- cd dist && echo "hashes =$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
73
- echo "hashes_ ${{ matrix.package }}=$(sha256sum * | base64 -w0)"
74
+ cd dist && echo "hash_${{ matrix.package }} =$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
75
+ echo "hash_ ${{ matrix.package }}=$(sha256sum * | base64 -w0)"
74
76
- uses : actions/upload-artifact@v4
75
77
with :
76
78
name : build-${{ matrix.package }}
77
79
path : ./dist
78
- - uses : actions/checkout@v4
79
- with :
80
- ref : ${{ github.head_ref }}
81
- - uses : ./.github/actions/provenance
82
- with :
83
- subjects : " ${{ steps.hash.outputs.hashes }}"
84
- tag : ${{ inputs.tag }}
85
- provenance-name : ${{ matrix.package }}.intoto.jsonl
86
-
80
+ debug :
81
+ runs-on : ubuntu-latest
82
+ needs : ['build']
83
+ steps :
84
+ - name : " Print hashes"
85
+ run : |
86
+ echo "output hashes ${{ needs.build.outputs.hashes }}"
87
+
88
+ provenance :
89
+ needs : ['path-filter', 'build']
90
+ permissions :
91
+ actions : read
92
+ contents : write
93
+ id-token : write # Needed to access the workflow's OIDC identity.
94
+ strategy :
95
+ fail-fast : false
96
+ matrix :
97
+ include : ${{ fromJSON(needs.path-filter.outputs.package-matrix) }}
98
+ uses : slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
99
+ with :
100
+ base64-subjects : ${{ needs.build.outputs.hashes[format('hashes_{}', matrix.package)] }}
101
+ # base64-subjects: ${{ needs.build.outputs.hashes.hash_lbox-clients }}
102
+ upload-assets : true
103
+ upload-tag-name : ${{ inputs.tag }}
104
+ provenance-name : ${{ matrix.package }}.intoto.jsonl
105
+
106
+
87
107
test-build :
88
108
needs : ['path-filter']
89
109
if : ${{ needs.path-filter.outputs.lbox == 'true' }}
0 commit comments