add attestation bundle to release artifacts #16

	name: Build an attested release on tag push
	on:
	push:
	tags:
	- 'v[0-9]+.[0-9]+.[0-9]+'

	permissions:
	id-token: write
	attestations: write
	contents: write

	env:
	PRODUCT_NAME: ${{ github.event.repository.name }}

	jobs:
	build-attested-release:
	runs-on: ubuntu-latest
	steps:
	- name: Setup Go
	uses: actions/setup-go@v5
	with:
	go-version: '^1.22'
	- name: Check out code
	uses: actions/checkout@v4
	- name: Get latest tag
	run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
	- name: Build the binary
	run: \|
	GOOS=linux GOARCH=amd64 go build -o ${{ env.PRODUCT_NAME }}-linux-amd64 main.go
	GOOS=darwin GOARCH=arm64 go build -o ${{ env.PRODUCT_NAME }}-darwin-arm64 main.go
	- name: Create the archive
	run: \|
	tar cvf ${{ env.PRODUCT_NAME }}-${{ env.RELEASE_VERSION }}.tar ${{ env.PRODUCT_NAME }}-*
	gzip ${{ env.PRODUCT_NAME }}-${{ env.RELEASE_VERSION }}.tar
	- name: Create attestation
	id: create-attestation
	uses: actions/attest-build-provenance@897ed5eab6ed058a474202017ada7f40bfa52940 # v1.0.0
	with:
	subject-path: "${{ env.PRODUCT_NAME }}-${{ env.RELEASE_VERSION }}.tar.gz"
	- name: Create release with attested artifact attached
	uses: ncipollo/release-action@v1
	with:
	tag: "${{ env.RELEASE_VERSION }}"
	artifacts: "${{ env.PRODUCT_NAME }}-${{ env.RELEASE_VERSION }}.tar.gz, ${{ steps.create-attestation.outputs.bundle-path }}"
	body: "${{ env.PRODUCT_NAME }} release ${{ env.RELEASE_VERSION }}"
	makeLatest: true

Provide feedback