Attest build files

VenomVendor · Jun 22, 2024 · 8f216b1 · 8f216b1
1 parent 145cb46
commit 8f216b1
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 1 deletion.
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -11,7 +11,9 @@ jobs:
     strategy:
       matrix:
         java: ["11", "21"]
-
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
 
@@ -55,6 +57,11 @@ jobs:
           compression-level: 9
           overwrite: true
 
+      - name: Attest
+        uses: actions/attest-build-provenance@v1.3.2
+        with:
+          subject-path: "build/libs/**/*"
+
   code-coverage:
     needs: build
     name: Test on Java 17

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -61,6 +61,9 @@ jobs:
     runs-on: ubuntu-latest
     environment: publish
     needs: code-coverage
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - name: Setup Java 11
@@ -90,3 +93,8 @@ jobs:
       - name: Remove Gradle cache lock file
         if: always()
         run: rm -rvf $HOME/.gradle/caches/modules-2/modules-2.lock
+
+      - name: Attest
+        uses: actions/attest-build-provenance@v1.3.2
+        with:
+          subject-path: "build/libs/**/*"