Merge pull request #146 from Shopify/thepwagner-patch-1

release: attest tarball provenance
Shopify · May 16, 2024 · 3b5a6c1 · 3b5a6c1
2 parents 8b8ff08 + b0119f5
commit 3b5a6c1
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -7,6 +7,8 @@ on:
 permissions:
   contents: write
   packages: write
+  id-token: write
+  attestations: write
 
 jobs:
   release:
@@ -29,10 +31,14 @@ jobs:
           mkdir -p tmp
           sed '/^# '$version'/,/^# /!d;//d;/^\s*$/d' CHANGELOG.md > tmp/release_changelog.md
       - name: Release
-        uses: goreleaser/goreleaser-action@5df302e5e9e4c66310a6b6493a8865b12c555af2
+        uses: goreleaser/goreleaser-action@5df302e5e9e4c66310a6b6493a8865b12c555af2 # v2.8.0
         with:
           distribution: goreleaser
-          version: v1.22.1
+          version: v1.25.1
           args: release --clean --release-notes=tmp/release_changelog.md
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: "Sign .tar.gz"
+        uses: actions/attest-build-provenance@951c0c5f8e375ad4efad33405ab77f7ded2358e4 # v1.1.1
+        with:
+          subject-path: "dist/*.tar.gz"