Merge pull request #114 from marcransome/slsa-provenance

Add SLSA provenance workflow

.github/workflows/slsa.yml

@@ -0,0 +1,40 @@
+name: SLSA Provenance
+on:
+  workflow_dispatch:
+
+permissions: read-all
+
+jobs:
+  build:
+    name: Build
+    runs-on: macos-latest
+    outputs:
+      hashes: "${{ steps.artifacts.outputs.hashes }}"
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
+    - name: Install dependencies
+      run: brew install popt
+    - id: artifacts
+      name: Build artifact and generate hashes
+      run: |
+        cmake -S . -B build -G Ninja
+        cmake --build build
+        cd build/src
+        echo "hashes=$(sha256sum flog | base64 -w0)" >> "$GITHUB_OUTPUT"
+    - name: Upload build artifact
+      uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
+      with:
+        name: flog
+        path: build/src/flog
+        if-no-files-found: error
+        retention-days: 7
+  provenance:
+    needs: [build]
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@c747fe7769adf3656dc7d588b161cb614d7abfee # v1.10.0
+    with:
+      base64-subjects: "${{ needs.build.outputs.hashes }}"