Create publish_release.yml

.github/workflows/publish_release.yml

@@ -0,0 +1,75 @@
+name: Publish release
+
+# on:
+#   push:
+#     tags: '[0-9]+.[0-9]+.[0-9][0-9]'
+
+on:
+  workflow_dispatch
+
+permissions: read-all
+
+jobs:
+  # This step builds our artifacts, uploads them to the workflow run, and
+  # outputs their digest.
+  build:
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Build artifacts
+        run: |
+          git archive --prefix=genten-${{ github.ref_name }}/ -o genten-${{ github.ref_name }}.zip HEAD
+          git archive --prefix=genten-${{ github.ref_name }}/ -o genten-${{ github.ref_name }}.tar.gz HEAD
+
+      - name: Generate hashes
+        shell: bash
+        id: hash
+        run: |
+          # sha256sum generates sha256 hash for all artifacts.
+          # base64 -w0 encodes to base64 and outputs on a single line.
+          sha256sum genten-${{ github.ref_name }}.zip genten-${{ github.ref_name }}.tar.gz > genten-${{ github.ref_name }}-SHA-256.txt
+          echo "hashes=$(base64 -w0 genten-${{ github.ref_name }}-SHA-256.txt)" >> "$GITHUB_OUTPUT"
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        with:
+          name: release-artifacts
+          path: genten-${{ github.ref_name }}*
+          if-no-files-found: error
+          retention-days: 5
+
+  # This step calls the generic workflow to generate provenance.
+  provenance:
+    needs: [build]
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+    with:
+      base64-subjects: "${{ needs.build.outputs.hashes }}"
+      # Upload provenance to a new release
+      upload-assets: true
+      provenance-name: "genten-${{ github.ref_name }}.intoto.jsonl"
+
+  # This step uploads our artifacts to the tagged GitHub release.
+  release:
+    needs: [build, provenance]
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: release-artifacts
+      - name: Upload assets
+        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
+        with:
+          files: |
+            genten-${{ github.ref_name }}.zip
+            genten-${{ github.ref_name }}.tar.gz
+            genten-${{ github.ref_name }}-SHA-256.txt