gittuf-rsl-main.yml

name: Record change to main branch
on:
  push:
    branches:
      - 'main'
jobs:
  create-rsl-entry:
    if: github.repository == 'in-toto/attestation-verifier'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
    steps:
      - name: Install gittuf
        uses: gittuf/gittuf-installer@f31e69c7c18c7473cbce18ed69a559b945d3a738
      - name: Install gitsign
        uses: chainguard-dev/actions/setup-gitsign@main
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
        with:
          fetch-depth: 0
      - name: Update RSL
        env:
          KEY: ${{ secrets.KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gittuf_key_path="/tmp/gittuf-key"
          echo "$KEY" > $gittuf_key_path
          chmod 600 $gittuf_key_path # ssh-keygen signer requires this

          git fetch origin refs/gittuf/reference-state-log:refs/gittuf/reference-state-log refs/gittuf/attestations:refs/gittuf/attestations
          GITTUF_DEV=1 gittuf dev attest-github --signing-key $gittuf_key_path --repository ${{ github.repository }} --commit ${{ github.sha }} --base-branch "main"
          gittuf rsl record main
          git push origin refs/gittuf/reference-state-log:refs/gittuf/reference-state-log refs/gittuf/attestations:refs/gittuf/attestations