From 580b3b309eaeea7be32ad4a952066e388a91095d Mon Sep 17 00:00:00 2001 From: s0me1newithhand7s Date: Sun, 19 Jul 2026 23:06:11 +0300 Subject: [PATCH 1/3] feat(ci): add attestaion step to build and container Signed-off-by: s0me1newithhand7s --- .github/workflows/build.yml | 12 +++++++++++- .github/workflows/container.yml | 24 ++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 40584e469..2b440a16b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -24,7 +24,7 @@ on: type: string default: Debug -permissions: { } +permissions: { } jobs: build: @@ -38,6 +38,8 @@ jobs: id-token: write # Required for vcpkg binary cache packages: write + # rq for GitHub Artifact Attestations + attestations: write strategy: fail-fast: false @@ -186,3 +188,11 @@ jobs: azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} + + - name: Attest Release Packages + if: ${{ inputs.build-type == 'Release' }} + # Pinning to actions/attest-build-provenance@v2.2.3 + # in case Dependabot update it. + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 + with: + subject-path: '${{ github.workspace }}/**/${{ matrix.artifact-name }}*' diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml index 84d7d2300..8c3c6b88a 100644 --- a/.github/workflows/container.yml +++ b/.github/workflows/container.yml @@ -22,6 +22,10 @@ jobs: permissions: contents: read packages: write + # attestations rq + id-token: write + attestations: write + # artifact-metadata: write outputs: image-name: ${{ steps.image-name.outputs.image-name }} @@ -105,6 +109,15 @@ jobs: if-no-files-found: error retention-days: 1 + - name: Attest Devcontainer Image + if: ${{ github.event_name != 'pull_request' }} + # Pinning to actions/attest-build-provenance@v2.2.3 + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 + with: + subject-name: ${{ steps.image-name.outputs.image-name }} + subject-digest: ${{ steps.id-push-image.outputs.digest }} + push-to-registry: true + manifest: name: Create manifest @@ -114,6 +127,10 @@ jobs: permissions: contents: read packages: write + # attestation rq + id-token: write + attestations: write + # artifact-metadata: write runs-on: ubuntu-24.04 @@ -172,3 +189,10 @@ jobs: username: ${{ github.repository_owner }} password: ${{ github.token }} tls-verify: true + + - name: Attest Multi-Arch Manifest + uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 + with: + subject-name: ${{ needs.build.outputs.image-name }} + subject-digest: ${{ steps.push-manifest.outputs.digest }} + push-to-registry: true From 9c5c65d5b06fcc0233626a65b755113e91b05183 Mon Sep 17 00:00:00 2001 From: s0me1newithhand7s Date: Mon, 20 Jul 2026 12:50:09 +0300 Subject: [PATCH 2/3] fix(ci): attest Signed-off-by: s0me1newithhand7s --- .github/workflows/build.yml | 6 ++---- .github/workflows/container.yml | 4 +--- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 2b440a16b..215fdc261 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -24,13 +24,11 @@ on: type: string default: Debug -permissions: { } - jobs: build: name: Build (${{ matrix.artifact-name }}) - environment: ${{ inputs.environment || '' }} + environment: ${{ inputs.environment }} permissions: contents: read @@ -190,7 +188,7 @@ jobs: azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - name: Attest Release Packages - if: ${{ inputs.build-type == 'Release' }} + if: ${{ steps.setup-dependencies.outputs.build-type == 'Release' }} # Pinning to actions/attest-build-provenance@v2.2.3 # in case Dependabot update it. uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml index 8c3c6b88a..f1cd99dda 100644 --- a/.github/workflows/container.yml +++ b/.github/workflows/container.yml @@ -10,8 +10,6 @@ on: pull_request: workflow_dispatch: -permissions: { } - env: REGISTRY: ghcr.io @@ -25,7 +23,7 @@ jobs: # attestations rq id-token: write attestations: write - # artifact-metadata: write + artifact-metadata: write outputs: image-name: ${{ steps.image-name.outputs.image-name }} From ff2992878911088eaa9752f0f2bf4f8fe72136f2 Mon Sep 17 00:00:00 2001 From: s0me1newithhand7s Date: Mon, 20 Jul 2026 13:27:34 +0300 Subject: [PATCH 3/3] fix(ci): attest Signed-off-by: s0me1newithhand7s --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 215fdc261..2c366375f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -193,4 +193,4 @@ jobs: # in case Dependabot update it. uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 with: - subject-path: '${{ github.workspace }}/**/${{ matrix.artifact-name }}*' + subject-path: ${{ github.workspace }}/**/${{ matrix.artifact-name }}