chore(.github/workflows/release.yml): add custom SLSA provenance and SPDX file upload to release workflow

Signed-off-by: Gaius <[email protected]>

Author: gaius-qi

.github/workflows/release.yml

@@ -64,12 +64,45 @@ jobs:
   provenance:
     needs: [goreleaser]
     permissions:
-      actions: read # To read the workflow path.
-      id-token: write # To sign the provenance.
-      contents: write # To add assets to a release.
-    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
-    with:
-      base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
-      upload-tag-name: "${{ needs.goreleaser.outputs.tag_name }}"
-      upload-assets: true # upload to a new release
-      draft-release: true
+      actions: read
+      id-token: write
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Generate SLSA Provenance
+        id: slsa
+        uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+        with:
+          base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
+          upload-assets: false
+
+      - name: Upload SLSA Provenance Attestation to Release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ needs.goreleaser.outputs.tag_name }}
+        run: |
+          set -euxo pipefail
+          PROVENANCE_FILE="multiple.intoto.jsonl"
+          SPDX_FILES="*.spdx.json"
+
+          files_to_upload=()
+          if [ -f "$PROVENANCE_FILE" ]; then
+            files_to_upload+=("$PROVENANCE_FILE")
+            echo "Found provenance file: $PROVENANCE_FILE"
+          else
+            echo "Provenance '$PROVENANCE_FILE' cannot be found."
+            exit 0
+          fi
+
+          found_spdx=$(find . -maxdepth 1 -name '*.spdx.json' -print)
+          if [ -n "$found_spdx" ]; then
+             while IFS= read -r file; do
+               files_to_upload+=("$file")
+               echo "Found SPDX file: $file"
+             done <<< "$found_spdx"
+          else
+            echo "$SPDX_FILES cannot be found."
+            exit 0
+          fi
+
+          gh release upload "$TAG_NAME" "${files_to_upload[@]}" --clobber