release-attestation.yml

name: Release Attestation

on:
  release:
    types: [published]
  workflow_dispatch:
    inputs:
      release_tag:
        description: "Release tag to attest"
        required: true
        type: string

jobs:
  attest-release-assets:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      attestations: write
      id-token: write
    steps:
      - name: Download release assets
        id: download
        run: |
          set -ex
          # Get the release tag from input or event
          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            RELEASE_TAG="${{ github.event.inputs.release_tag }}"
          else
            RELEASE_TAG="${{ github.event.release.tag_name }}"
          fi
          echo "release_tag=$RELEASE_TAG" >> $GITHUB_OUTPUT
          gh release download -R microsoft/ccf $RELEASE_TAG -D release-assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Attest release assets
        uses: actions/attest-build-provenance@v2
        with:
          subject-path: "release-assets/*"