midgard/.github/workflows/release.yml at master · AlphaOne1/midgard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
# SPDX-FileCopyrightText: 2026 The midgard contributors.
# SPDX-License-Identifier: MPL-2.0

name: Release

on:
    release:
        types:
          - prereleased
          - published

permissions: read-all

concurrency:
    group: release-${{ github.event.release.tag_name }}
    cancel-in-progress: true

jobs:
    Build:
        permissions:
            contents: write
        runs-on: ubuntu-latest
        steps:
          - name: Harden Runner
            uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
            with:
                egress-policy: audit

          - name: Checkout
            uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
            with:
                fetch-depth: 0
                ref: ${{ github.event.release.tag_name }}

          - name: Set Project Name
            shell: bash
            run: |
                PROJECT_NAME=$(go list -m | sed -r 's/(.*\/)*(.+)/\2/')
                echo "PROJECT_NAME=$PROJECT_NAME" >> $GITHUB_ENV

          - name: Generate SBOM with Syft
            uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
            with:
                path: .
                output-file: ${{ env.PROJECT_NAME }}-sbom.spdx.json
                upload-artifact: false
                upload-release-assets: false

          - name: Generate source archive
            shell: bash
            env:
                TAG_NAME: ${{ github.event.release.tag_name }}
            run: |
                set -euo pipefail

                TAG=`echo "$TAG_NAME" | sed 's/\//-/g'`
                git archive \
                    --format=tar.gz \
                    --prefix="${{ env.PROJECT_NAME }}-src-${TAG}/" \
                    --output="${{ env.PROJECT_NAME }}-src-${TAG}.tar.gz" \
                    "$TAG_NAME"

          - name: Upload Release (via GitHub CLI)
            env:
                GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                TAG_NAME: ${{ github.event.release.tag_name }}
            shell: bash
            run: |
                set -euo pipefail

                PROJECT_NAME=`go list -m | sed -r 's/(.*\/)*(.+)/\2/'`
                gh release upload "$TAG_NAME"    \
                    ${PROJECT_NAME}-src-*.tar.gz \
                    ${PROJECT_NAME}-sbom.spdx.json --clobber

    ChecksumReleaseAssets:
        needs: Build
        runs-on: ubuntu-latest
        name: Checksum Release Assets
        outputs:
            hashBase64File: ${{ steps.hashes.outputs.handle }}
        steps:
          - name: Harden Runner
            uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
            with:
                egress-policy: audit

          - name: Checkout
            uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
            with:
                fetch-depth: 1

          - name: Download all release assets via GitHub CLI
            env:
                GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
                TAG_NAME: ${{ github.event.release.tag_name }}
            run: |
                set -euo pipefail

                mkdir -p release-assets
                cd release-assets
                # gets all assets of the release
                gh release download "$TAG_NAME" --clobber
                echo "Downloaded assets:"
                ls -lah

          - name: Generate Checksums
            working-directory: release-assets
            run: |
                set -euo pipefail

                # Robustly hash all regular files in this directory, then base64 and write via tee.
                LC_ALL=C find . -maxdepth 1 -type f -printf '%P\0' \
                  | sort -z \
                  | xargs -0 sha256sum -- \
                  | base64 -w0 \
                  > check.sha256

          - name: Upload Checksums
            id: hashes
            uses: slsa-framework/slsa-github-generator/actions/generator/generic/create-base64-subjects-from-file@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # 2.1.0
            with:
                path: release-assets/check.sha256

    AssetProvenance:
        permissions:
            actions:  read  # Needed for detection of GitHub Actions environment.
            id-token: write # Needed for provenance signing and ID
            contents: write # Needed for release uploads
        needs: ChecksumReleaseAssets
        uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 #must have semver!
        with:
            base64-subjects-as-file: |
                ${{ needs.ChecksumReleaseAssets.outputs.hashBase64File }}
            upload-assets: true
            upload-tag-name: "${{ github.event.release.tag_name }}"