Generate signed build provenance attestations

messense · Sep 19, 2024 · 86c3f44 · 86c3f44
1 parent 42a8a67
commit 86c3f44
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/.github/workflows/Build.yml b/.github/workflows/Build.yml
@@ -9,6 +9,10 @@ on:
 
 name: Build
 
+permissions:
+  id-token: write
+  attestations: write
+
 jobs:
   build:
     name: Build ${{ matrix.target }} for ${{ matrix.os.arch }}
@@ -69,6 +73,9 @@ jobs:
           cd -
           mv /Volumes/tools/${{ matrix.target }}-${{ matrix.os.arch }}-darwin.tar.gz .
           sha256sum ${{ matrix.target }}-${{ matrix.os.arch }}-darwin.tar.gz | tee ${{ matrix.target }}-${{ matrix.os.arch }}-darwin.tar.gz.sha256
+      - uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ${{ matrix.target }}-${{ matrix.os.arch }}-darwin.tar.gz
       - name: Upload Toolchain
         uses: actions/upload-artifact@v4
         with: