Attest binary source

Author: Taknok

.github/workflows/build.yml

@@ -18,6 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       id-token: write
+      contents: read
       attestations: write
     strategy:
       matrix:
@@ -47,13 +48,14 @@ jobs:
           cmake -GNinja -Dprotobuf_BUILD_TESTS=OFF ..
           ninja -j$(nproc --all)
           popd
-        env:
-          NDK_TOOLCHAIN: ${{ steps.setup-ndk.outputs.ndk-path }}/toolchains/llvm/prebuilt/linux-x86_64
 
       - name: Compiling aapt2
         run: python3 ./build.py --ndk=${{ steps.setup-ndk.outputs.ndk-path }} --abi=${{ matrix.target_arch }} --build="build/${{ matrix.target_arch }}" --protoc=/${{ github.workspace }}/src/protobuf/build/protoc --target aapt2
-        env:
-          NDK_TOOLCHAIN: ${{ steps.setup-ndk.outputs.ndk-path }}/toolchains/llvm/prebuilt/linux-x86_64
+
+      - name: Generating attestation of the generated aapt2
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: ${{ github.workspace }}/build/${{ matrix.target_arch }}/bin/aapt2
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4