Add SLSA 3 Provenance #311
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Release Library | ||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| pull_request: | ||
| branches: | ||
| - main | ||
| permissions: | ||
| id-token: write # Required for OIDC provenance signing | ||
| contents: write # Required for uploading provenance | ||
| actions: read | ||
| jobs: | ||
| build-library: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-java@v4 | ||
| with: | ||
| distribution: temurin | ||
| java-version: 17 | ||
| - name: Change wrapper permissions | ||
| run: chmod +x pi4micronaut-utils/gradlew | ||
| - name: Setup Gradle | ||
| uses: gradle/gradle-build-action@v2 | ||
| with: | ||
| arguments: build | ||
| build-root-directory: pi4micronaut-utils/ | ||
| - name: Execute Gradle build with info logging | ||
| working-directory: pi4micronaut-utils | ||
| run: ./gradlew build --info | ||
| - name: Execute Gradle shadowJar | ||
| working-directory: pi4micronaut-utils | ||
| run: ./gradlew shadowJar | ||
| - name: Upload JAR artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: pi4micronaut-jar | ||
| path: pi4micronaut-utils/build/libs/*.jar | ||
| provenance: | ||
| needs: build-library | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/attest-build-provenance.yml@v2.1.0 | ||
|
Check failure on line 52 in .github/workflows/build-library-jar.yml
|
||
| with: | ||
| subject-path: "pi4micronaut-utils/build/libs/*.jar" | ||
| permissions: | ||
| actions: read | ||
| id-token: write | ||
| contents: write | ||
| publish-jar: | ||
| runs-on: ubuntu-latest | ||
| needs: [build-library, provenance] | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Set up Java | ||
| uses: actions/setup-java@v4 | ||
| with: | ||
| java-version: '17' | ||
| distribution: 'temurin' | ||
| cache: 'gradle' | ||
| - name: Change wrapper permissions | ||
| run: chmod +x pi4micronaut-utils/gradlew | ||
| - name: Publish Library | ||
| working-directory: pi4micronaut-utils | ||
| env: | ||
| SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} | ||
| SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} | ||
| GPG_KEY: ${{ secrets.GPG_KEY }} | ||
| GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }} | ||
| run: ./gradlew clean publish --info | ||
