chore(.github/workflows/release.yml): add custom SLSA provenance and SPDX file upload to release workflow

Signed-off-by: Gaius <gaius.qi@gmail.com>

Author: gaius-qi

.github/workflows/release.yml

@@ -64,12 +64,56 @@ jobs:
   provenance:
     needs: [goreleaser]
     permissions:
-      actions: read # To read the workflow path.
-      id-token: write # To sign the provenance.
-      contents: write # To add assets to a release.
+      id-token: write
+      contents: read
+      actions: read
     uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
     with:
       base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
-      upload-tag-name: "${{ needs.goreleaser.outputs.tag_name }}"
-      upload-assets: true # upload to a new release
-      draft-release: true
+      upload-assets: true
+
+  upload-provenance:
+    needs: [goreleaser, provenance]
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download SLSA provenance artifacts
+        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e # v4.2.1
+        with:
+          pattern:
+            multiple.intoto.jsonl
+            *.spdx.json
+
+      - name: Upload SLSA Provenance Attestation to Release
+        env:
+          TAG_NAME: ${{ needs.goreleaser.outputs.tag_name }}
+        run: |
+          set -euxo pipefail
+          PROVENANCE_FILE="multiple.intoto.jsonl"
+          SPDX_FILES="*.spdx.json"
+
+          files_to_upload=()
+          if [ -f "$PROVENANCE_FILE" ]; then
+            files_to_upload+=("$PROVENANCE_FILE")
+          else
+            echo "Provenance cannot be found."
+            exit 1
+          fi
+
+          found_spdx=$(find . -maxdepth 1 -name '*.spdx.json' -print)
+          if [ -n "$found_spdx" ]; then
+             while IFS= read -r file; do
+               files_to_upload+=("$file")
+             done <<< "$found_spdx"
+          else
+            echo "$SPDX_FILES not found."
+            exit 1
+          fi
+
+          if [ ${#files_to_upload[@]} -eq 0 ]; then
+            echo "No files to upload."
+            exit 1
+          fi
+
+          gh release upload "$TAG_NAME" "${files_to_upload[@]}" --clobber