ci: attest results of guix builds

dashpay · Oct 22, 2024 · cd712e8 · cd712e8
1 parent dd33182
commit cd712e8
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/.github/workflows/guix-build.yml b/.github/workflows/guix-build.yml
@@ -2,6 +2,8 @@ name: Guix Build
 
 permissions:
   packages: write
+  id-token: write
+  attestations: write
 
 on:
   pull_request_target:
@@ -127,3 +129,7 @@ jobs:
           path: |
             ${{ github.workspace }}/dash/guix-build*/output/${{ matrix.build_target }}/
 
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ${{ github.workspace }}/dash/guix-build*/output/${{ matrix.build_target }}/*