Add SLSA 3 Provenance #314
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build, Test, and Release with SLSA | |
| on: | |
| push: | |
| branches: | |
| - main # Provenance only on main | |
| pull_request: # CI/build tests for all PRs | |
| workflow_dispatch: # Manual trigger for provenance or test runs | |
| permissions: | |
| id-token: write # Required for OIDC (SLSA) | |
| contents: read | |
| actions: read | |
| packages: write | |
| jobs: | |
| # ------------------- | |
| # CI / Build for all PRs and pushes | |
| # ------------------- | |
| build-library: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: 17 | |
| - name: Change wrapper permissions | |
| run: chmod +x pi4micronaut-utils/gradlew | |
| - name: Execute Gradle build | |
| working-directory: pi4micronaut-utils | |
| run: ./gradlew build --info | |
| - name: Execute Gradle shadowJar | |
| working-directory: pi4micronaut-utils | |
| run: ./gradlew shadowJar | |
| - name: Upload JAR artifact (for CI) | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: pi4micronaut-jar | |
| path: pi4micronaut-utils/build/libs/*.jar | |
| # ------------------- | |
| # Generate SLSA provenance (only on main or manual) | |
| # ------------------- | |
| slsa-build: | |
| needs: build-library | |
| if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch' | |
| uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@v2.1.0 | |
| with: | |
| artifact-list: pi4micronaut-utils/build/libs/*.jar | |
| permissions: | |
| id-token: write | |
| contents: read | |
| actions: read | |
| # ------------------- | |
| # Publish JAR to Sonatype / Maven (only after main + SLSA) | |
| # ------------------- | |
| publish-jar: | |
| runs-on: ubuntu-latest | |
| needs: [build-library, slsa-build] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Java | |
| uses: actions/setup-java@v4 | |
| with: | |
| distribution: temurin | |
| java-version: 17 | |
| cache: gradle | |
| - name: Change wrapper permissions | |
| run: chmod +x pi4micronaut-utils/gradlew | |
| - name: Publish Library | |
| working-directory: pi4micronaut-utils | |
| env: | |
| SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} | |
| SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} | |
| GPG_KEY: ${{ secrets.GPG_KEY }} | |
| GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }} | |
| run: ./gradlew clean publish --info |