Support Github Artifact Attestations

[smlx]

Support Github Artifact Attestations

[smlx]

This is actually pretty simple to do yourself in case anyone else is interested:

    - uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
      id: goreleaser
      with:
        version: latest
        args: release --clean
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    # parse artifacts to the format required for image attestation
    - run: |
        echo "digest=$(echo "$ARTIFACTS" | jq -r '.[]|select(.type=="Docker Manifest")|select(.name|test(":v"))|.extra.Digest')" >> "$GITHUB_OUTPUT"
        echo "name=$(echo "$ARTIFACTS" | jq -r '.[]|select(.type=="Docker Manifest")|select(.name|test(":v"))|.name|split(":")[0]')" >> "$GITHUB_OUTPUT"
      id: image_metadata
      env:
        ARTIFACTS: ${{steps.goreleaser.outputs.artifacts}}
    # attest archives
    - uses: actions/attest-build-provenance@173725a1209d09b31f9d30a3890cf2757ebbff0d # v1.1.2
      with:
        subject-path: "dist/*.tar.gz"
    # attest image
    - uses: actions/attest-build-provenance@173725a1209d09b31f9d30a3890cf2757ebbff0d # v1.1.2
      with:
        subject-digest: ${{steps.image_metadata.outputs.digest}}
        subject-name: ${{steps.image_metadata.outputs.name}}
        push-to-registry: true