Build an attested release on tag push #5

	name: Build an attested release
	on:
	workflow_dispatch:

	permissions:
	id-token: write
	attestations: write
	contents: write

	env:
	PRODUCT_NAME: ${{ github.event.repository.name }}

	jobs:
	build-attested-release:
	runs-on: ubuntu-latest
	steps:
	- name: Setup Go
	uses: actions/setup-go@v5
	with:
	go-version: '^1.22'
	- name: Check out code
	uses: actions/checkout@v4
	- name: Generate random release identifier
	run: \|
	echo "PRODUCT_RELEASE_ID=$(uuidgen \| cut -d '-' -f 1 \| tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV
	- name: Build the binary
	run: \|
	GOOS=linux GOARCH=amd64 go build -o ${{ env.PRODUCT_NAME }}-linux-amd64 main.go
	GOOS=darwin GOARCH=arm64 go build -o ${{ env.PRODUCT_NAME }}-darwin-arm64 main.go
	- name: Create the archive
	run: \|
	tar cvf ${{ env.PRODUCT_NAME }}-${{ env.PRODUCT_RELEASE_ID }}.tar ${{ env.PRODUCT_NAME }}-*
	gzip ${{ env.PRODUCT_NAME }}-${{ env.PRODUCT_RELEASE_ID }}.tar
	- name: Create attestation
	uses: actions/attest-build-provenance@897ed5eab6ed058a474202017ada7f40bfa52940 # v1.0.0
	with:
	subject-path: "${{ env.PRODUCT_NAME }}-${{ env.PRODUCT_RELEASE_ID }}.tar.gz"
	- name: Create release with attested artifact attached
	uses: ncipollo/release-action@v1
	with:
	tag: "${{ env.PRODUCT_RELEASE_ID }}"
	artifacts: "${{ env.PRODUCT_NAME }}-${{ env.PRODUCT_RELEASE_ID }}.tar.gz"
	body: "${{ env.PRODUCT_NAME }} release ${{ env.PRODUCT_RELEASE_ID }}"

Provide feedback