slsa.yml

---
name: SLSA
on:
  push:
  release:
    permissions:
      contents: write
    types: [published, released]

permissions:
  contents: read

jobs:
  build:
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - run: echo "REPOSITORY_NAME=$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')" >> $GITHUB_ENV
        shell: bash

      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Build artifacts
        run: |
          find defaults handlers tasks templates -type f -exec sha256sum {} \; > ${{ env.REPOSITORY_NAME }}.sha256

      - name: Generate hashes
        shell: bash
        id: hash
        run: |
          echo "hashes=$(sha256sum ${{ env.REPOSITORY_NAME }}.sha256 | base64 -w0)" >> "$GITHUB_OUTPUT"

      - name: Upload ${{ env.REPOSITORY_NAME }}.sha256
        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: ${{ env.REPOSITORY_NAME }}.sha256
          path: ${{ env.REPOSITORY_NAME }}.sha256
          if-no-files-found: error
          retention-days: 5

  provenance:
    needs: [build]
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      upload-assets: ${{ startsWith(github.ref, 'refs/tags/') }}

  release:
    permissions:
      actions: read
      id-token: write
      contents: write
    needs: [build, provenance]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    steps:
      - run: echo "REPOSITORY_NAME=$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')" >> $GITHUB_ENV
        shell: bash

      - name: Download ${{ env.REPOSITORY_NAME }}.sha256
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: ${{ env.REPOSITORY_NAME }}.sha256

      - name: Upload asset
        uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8 # v2.0.9
        with:
          files: |
            ${{ env.REPOSITORY_NAME }}.sha256