Skip to content

ci: attest immutable release assets #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mcollina wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: attest immutable release assets #49

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,7 @@ jobs:
- build-libraries
- build-binaries
permissions:
attestations: write
id-token: write
contents: write
steps:
Expand Down Expand Up @@ -256,11 +257,20 @@ jobs:
mv /tmp/artifacts/milo-parser-bin-linux/milo-parser-bin-linux.tar.gz /tmp/release/
mv /tmp/artifacts/milo-parser-bin-macos-arm/milo-parser-bin-macos-arm.tar.gz /tmp/release/
mv /tmp/artifacts/milo-parser-bin-macos-intel/milo-parser-bin-macos-intel.tar.gz /tmp/release/
(cd /tmp/release && sha256sum *.tar.gz > SHA256SUMS)
- name: Attest native release assets
uses: actions/attest-build-provenance@v3
with:
subject-path: '/tmp/release/*.tar.gz'
- name: Push release commit and tag
run: |
if git rev-parse --verify --quiet "refs/tags/v${{ inputs.version }}"; then
echo "Release tag v${{ inputs.version }} already exists" >&2
exit 1
fi
git add -f package.json CHANGELOG.md parser/Cargo.toml parser/Cargo.lock macros/Cargo.toml macros/Cargo.lock references/rust/Cargo.toml references/rust/Cargo.lock parser/wasm/src/package.json
git commit -m "chore: Updated version."
git tag -f "v${{ inputs.version }}"
git tag "v${{ inputs.version }}"
- name: Publish macros on crates.io
run: cargo publish
working-directory: macros
Expand All @@ -280,7 +290,7 @@ jobs:
- name: Publish on GitHub
run: |
cambi release -n > /tmp/release-notes.txt
git push origin && git push origin -f --tags
git push origin && git push origin --tags
gh release create "v${{ inputs.version }}" -t "${{ inputs.version }}" ${{ github.event.inputs.prerelease == 'true' && '--prerelease' || '' }} -F /tmp/release-notes.txt /tmp/release/*
env:
GH_TOKEN: ${{ github.token }}
Loading