ci.yaml

name: Release

on:
  workflow_dispatch:
  release:
    types: [created]

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v3       # TODO(mihaimaruseac): pin by hash
      - name: Setup Haskell
        uses: haskell/actions/setup@v1  # TODO(mihaimaruseac): pin by hash
        with:
          enable-stack: true
      - name: Build artifacts
        run: |
          stack build
          cp $(stack path --local-install-root)/bin/slsa-test-repo .
      - name: Generate subject for provenance
        id: hash
        run: |
          set -euo pipefail
          echo "::set-output name=hashes::$(sha256sum slsa-test-repo | base64 -w0)"
      - name: Upload artifacts
        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3.1.0
        with:
          name: slsa-test-repo
          path: slsa-test-repo
          if-no-files-found: error
          retention-days: 5

  provenance:
    needs: [build]
    permissions:
      actions: read
      id-token: write
      contents: read
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.1.1  # TODO(mihaimaruseac): pin by hash
    with:
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      #upload-assets: true  # TODO(mihaimaruseac): Resolve with new release

  release:
    needs: [build, provenance]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - name: Download artifact
        uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # tag=v2.1.0
        with:
          name: slsa-test-repo
      - name: Download attestation
        uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # tag=v2.1.0
        with:
          name: attestation.intoto.jsonl
      - name: Upload assets
        uses: softprops/action-gh-release@1e07f4398721186383de40550babbdf2b84acfc5 # v0.1.14
        with:
          files: |
            slsa-test-repo
            attestation.intoto.jsonl