build-attested-release.yml

name: Build an attested release on tag push
on:
  push:
    tags:
      - 'v[0-9]+.[0-9]+.[0-9]+'

permissions:
  id-token: write
  attestations: write
  contents: write

env:
  PRODUCT_NAME: ${{ github.event.repository.name }}

jobs:
  build-attested-release:
    runs-on: ubuntu-latest
    steps:
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: '^1.22'
      - name: Check out code
        uses: actions/checkout@v4
      - name: Get latest tag
        run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
      - name: Build the binaries and archive
        run: |
          make build-release
      - name: Create attestation
        id: create-attestation
        uses: actions/attest-build-provenance@897ed5eab6ed058a474202017ada7f40bfa52940 # v1.0.0
        with:
          subject-path: "${{ env.PRODUCT_NAME }}-${{ env.RELEASE_VERSION }}.tar.gz"
      - name: Create release with attested artifact attached
        uses: ncipollo/release-action@v1
        with:
          tag: "${{ env.RELEASE_VERSION }}"
          artifacts: "${{ env.PRODUCT_NAME }}-${{ env.RELEASE_VERSION }}.tar.gz"
          body: "${{ env.PRODUCT_NAME }} release ${{ env.RELEASE_VERSION }}"
          makeLatest: true