add attestation bundle to release artifacts

finnigja · May 3, 2024 · f7fcb48 · f7fcb48
1 parent 678ca5c
commit f7fcb48
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/.github/workflows/build-attested-release.yml b/.github/workflows/build-attested-release.yml
@@ -33,13 +33,14 @@ jobs:
           tar cvf ${{ env.PRODUCT_NAME }}-${{ env.RELEASE_VERSION }}.tar ${{ env.PRODUCT_NAME }}-*
           gzip ${{ env.PRODUCT_NAME }}-${{ env.RELEASE_VERSION }}.tar
       - name: Create attestation
+        id: create-attestation
         uses: actions/attest-build-provenance@897ed5eab6ed058a474202017ada7f40bfa52940 # v1.0.0
         with:
           subject-path: "${{ env.PRODUCT_NAME }}-${{ env.RELEASE_VERSION }}.tar.gz"
       - name: Create release with attested artifact attached
         uses: ncipollo/release-action@v1
         with:
           tag: "${{ env.RELEASE_VERSION }}"
-          artifacts: "${{ env.PRODUCT_NAME }}-${{ env.RELEASE_VERSION }}.tar.gz"
+          artifacts: "${{ env.PRODUCT_NAME }}-${{ env.RELEASE_VERSION }}.tar.gz, ${{ steps.create-attestation.outputs.bundle-path }}"
           body: "${{ env.PRODUCT_NAME }} release ${{ env.RELEASE_VERSION }}"
           makeLatest: true