Create generator-generic-ossf-slsa3-publish.yml

.github/workflows/generator-generic-ossf-slsa3-publish.yml

@@ -0,0 +1,99 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow lets you generate SLSA provenance file for your project.
+# The generation satisfies level 3 for the provenance requirements - see https://slsa.dev/spec/v0.1/requirements
+# The project is an initiative of the OpenSSF (openssf.org) and is developed at
+# https://github.com/slsa-framework/slsa-github-generator.
+# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
+# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.
+
+name: SLSA generic generator
+on:
+ workflow_dispatch:
+ release:
+ types: [created]
+
+jobs:
+ build:
+ runs-on: ubuntu-latest
+ outputs:
+ digests: ${{ steps.hash.outputs.digests }}
+
+ steps:
+ - uses: actions/checkout@v3
+
+ # ========================================================
+ #
+ # Step 1: Build your artifacts.
+ #
+ # ========================================================
+ - name: Build artifacts
+ run: |
+ # These are some amazing artifacts.
+ echo "artifact1" > artifact1
+ echo "artifact2" > artifact2
+
+ # ========================================================
+ #
+ # Step 2: Add a step to generate the provenance subjects
+ # as shown below. Update the sha256 sum arguments
+ # to include all binaries that you generate
+ # provenance for.
+ #
+ # ========================================================
+ - name: Generate subject for provenance
+ id: hash
+ run: |
+ set -euo pipefail
+
+ # List the artifacts the provenance will refer to.
+ files=$(ls artifact*)
+ # Generate the subjects (base64 encoded).
+ echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}"
+
+ provenance:
+ needs: [build]
+ permissions:
+ actions: read # To read the workflow path.
+ id-token: write # To sign the provenance.
+ contents: write # To add assets to a release.
+ uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+ with:
+ base64-subjects: "${{ needs.build.outputs.digests }}"
+ upload-assets: true # Optional: Upload to a new release
+- name: Setup Go environment
+ uses: actions/[email protected]
+ with:
+ # The Go version to download (if necessary) and use. Supports semver spec and ranges. Be sure to enclose this option in single quotation marks.
+ go-version: # optional
+ # Path to the go.mod or go.work file.
+ go-version-file: # optional
+ # Set this option to true if you want the action to always check for the latest available version that satisfies the version spec
+ check-latest: # optional
+ # Used to pull Go distributions from go-versions. Since there's a default, this is typically not supplied by the user. When running this action on github.com, the default value is sufficient. When running on GHES, you can pass a personal access token for github.com if you are experiencing rate limiting.
+ token: # optional, default is ${{ github.server_url == 'https://github.com' && github.token || '' }}
+ # Used to specify whether caching is needed. Set to true, if you'd like to enable caching.
+ cache: # optional, default is true
+ # Used to specify the path to a dependency file - go.sum
+ cache-dependency-path: # optional
+ # Target architecture for Go to use. Examples: x86, x64. Will use system architecture by default.
+ architecture: # optional- name: Cache
+ uses: actions/[email protected]
+ with:
+ # A list of files, directories, and wildcard patterns to cache and restore
+ path: 
+ # An explicit key for restoring and saving the cache
+ key: 
+ # An ordered list of keys to use for restoring stale cache if no cache hit occurred for key. Note `cache-hit` returns false in this case.
+ restore-keys: # optional
+ # The chunk size used to split up large files during upload, in bytes
+ upload-chunk-size: # optional
+ # An optional boolean when enabled, allows windows runners to save or restore caches that can be restored or saved respectively on other platforms
+ enableCrossOsArchive: # optional, default is false
+ # Fail the workflow if cache entry is not found
+ fail-on-cache-miss: # optional, default is false
+ # Check if a cache entry exists for the given input(s) (key, restore-keys) without downloading the cache
+ lookup-only: # optional, default is false