slsa-goreleaser.yml

name: SLSA releaser
on:
  workflow_dispatch:
  # push:
  #   tags:
  #     - "*"

permissions: read-all

jobs:
  # Generate ldflags dynamically.
  args:
    runs-on: ubuntu-latest
    outputs:
      ldflags: ${{ steps.ldflags.outputs.value }}
      go-binary-name: ${{ steps.build.outputs.go-binary-name }}
    steps:
      - id: checkout
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v2.3.4
        with:
          fetch-depth: 0
      - id: ldflags
        run: |
          echo "value=$(./scripts/version-ldflags)" >> "$GITHUB_OUTPUT"
  # Trusted builder.
  build:
    permissions:
      id-token: write
      contents: write
      actions: read
    needs: args
    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.5.0 #7f4fdb871876c23e455853d694197440c5a91506
    with:
      go-version: 1.19
      evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"

  verification:
    needs:
      - build
    runs-on: ubuntu-latest
    permissions: read-all
    steps:
      - name: Install the verifier
        uses: slsa-framework/slsa-verifier/actions/installer@v2.2.0

      - name: Download the artifact
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
          name: "${{ needs.build.outputs.go-binary-name }}.intoto.jsonl"

      - name: Download the artifact
        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
        with:
          name: ${{ needs.build.outputs.go-binary-name }}

      - name: Verify assets
        env:
          ARTIFACT: ${{ needs.build.outputs.go-binary-name }}
          ATT_FILE_NAME: "${{ needs.build.outputs.go-binary-name }}.intoto.jsonl"
        run: |
          set -euo pipefail

          echo "Verifying $ARTIFACT using $ATT_FILE_NAME"
          slsa-verifier verify-artifact --provenance-path "$ATT_FILE_NAME" \
                                        --source-uri "github.com/$GITHUB_REPOSITORY" \
                                        "$ARTIFACT"