public-mirrors
/
composer
mirror of https://github.com/composer/composer
1
0
Fork 0
Code

Merge pull request #12258 from TimWolla/release-attest-build-provenance 

Generate build provenance attestation during release
pull/12247/head
Jordi Boggiano 2025-01-10 16:29:15 +01:00 committed by GitHub
parent a2fcc1a4db 089972db87
commit efe91c76e8
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
.github/workflows/release.yml vendored
View File

@ -15,6 +15,8 @@ jobs:
build: build:
permissions: permissions:
contents: write # for actions/create-release to create a release contents: write # for actions/create-release to create a release
id-token: write # for actions/attest-build-provenance to create a attestation certificate
attestations: write # for actions/attest-build-provenance to upload the attestation
name: Upload Release Asset name: Upload Release Asset
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
@ -41,6 +43,11 @@ jobs:
- name: Build phar file - name: Build phar file
run: "php -d phar.readonly=0 bin/compile" run: "php -d phar.readonly=0 bin/compile"
- name: Generate build provenance attestation
uses: actions/attest-build-provenance@v2
with:
subject-path: '${{ github.workspace }}/composer.phar'
- name: Create release - name: Create release
id: create_release id: create_release
uses: actions/create-release@v1 uses: actions/create-release@v1