From 78f491aac2b9bcb45c249f65b58b628ec90d615c Mon Sep 17 00:00:00 2001 From: Hayden B Date: Tue, 13 Feb 2024 11:18:58 -0800 Subject: [PATCH] Update java build workflow (#228) This updates the generation and upload of the provenance, which broke due to the actions/artifact-upload breaking change. We now generate a draft release first, then generate provenance and upload to the existing draft release. Signed-off-by: Hayden B --- .github/workflows/java-build-for-release.yml | 30 +++++++++----------- 1 file changed, 14 insertions(+), 16 deletions(-) diff --git a/.github/workflows/java-build-for-release.yml b/.github/workflows/java-build-for-release.yml index 3d88ed1d..c7ddd246 100644 --- a/.github/workflows/java-build-for-release.yml +++ b/.github/workflows/java-build-for-release.yml @@ -56,28 +56,12 @@ jobs: path: ./java/build/release/ if-no-files-found: error - provenance: - needs: [build, strip-tag] - permissions: - actions: read # To read the workflow path. - id-token: write # To sign the provenance. - contents: write - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 - with: - attestation-name: "protobuf-specs-${{ needs.strip-tag.outputs.version }}.attestation.intoto.jsonl" - base64-subjects: "${{ needs.build.outputs.hashes }}" - create-release: runs-on: ubuntu-latest needs: [provenance, build] permissions: contents: write # To draft a release steps: - - name: Download attestation - uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe # v4.1.2 - with: - name: "${{ needs.provenance.outputs.attestation-name }}" - path: ./release/ - name: Download gradle release artifacts uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe # v4.1.2 with: @@ -90,3 +74,17 @@ jobs: tag_name: ${{ github.ref_name }} files: ./release/* draft: true + + provenance: + needs: [build, strip-tag, create-release] + permissions: + actions: read # To read the workflow path. + id-token: write # To sign the provenance. + contents: write + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + with: + attestation-name: "protobuf-specs-${{ needs.strip-tag.outputs.version }}.attestation.intoto.jsonl" + upload-assets: true + base64-subjects: "${{ needs.build.outputs.hashes }}" + upload-tag-name: "${{ github.ref_name }}" # Upload to tag rather than generate a new release + draft-release: true