Skip to content

Use attestation instead of signature #1728

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 20, 2025
+19 −7
Merged

Use attestation instead of signature #1728

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 15 additions & 5 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ jobs:
release:
permissions:
contents: write # for creating the release
id-token: write # for signing artifacts with Sigstore
attestations: write # for uploading attestations
runs-on: ubuntu-latest
needs:
- common
Expand Down Expand Up @@ -152,16 +154,24 @@ jobs:
.github/scripts/generate-release-contributors.sh v$PRIOR_VERSION >> /tmp/release-notes.txt
fi

- id: create-github-release
name: Create GitHub release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Simplify paths for attaching
run: |
cp jmx-metrics/build/libs/opentelemetry-jmx-metrics-$VERSION-alpha.jar opentelemetry-jmx-metrics.jar
cp jmx-metrics/build/libs/opentelemetry-jmx-metrics-$VERSION-alpha.jar.asc opentelemetry-jmx-metrics.jar.asc
cp jmx-scraper/build/libs/opentelemetry-jmx-scraper-$VERSION-alpha.jar opentelemetry-jmx-scraper.jar
cp jmx-scraper/build/libs/opentelemetry-jmx-scraper-$VERSION-alpha.jar.asc opentelemetry-jmx-scraper.jar.asc


- uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
with:
subject-path: |
opentelemetry-jmx-metrics.jar
opentelemetry-jmx-scraper.jar

- id: create-github-release
name: Create GitHub release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh release create --target $GITHUB_REF_NAME \
--title "Version $VERSION" \
--notes-file /tmp/release-notes.txt \
Expand Down
6 changes: 4 additions & 2 deletions RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,8 +58,10 @@ and deadlocks.
* Run the [Release workflow](https://github.com/open-telemetry/opentelemetry-java-contrib/actions/workflows/release.yml).
* Press the "Run workflow" button, then select the release branch from the dropdown list,
e.g. `release/v1.9.x`, and click the "Run workflow" button below that.
* This workflow will publish the artifacts to maven central and will publish a GitHub release
with release notes based on the change log and with the jmx metrics jar attached.
* This workflow will:
* Publish the artifacts to Maven Central
* Generate [GitHub Artifact Attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations) for the JMX Metrics and JMX Scraper jars
* Publish a GitHub release with release notes based on the change log and with the jars attached
* Review and merge the pull request that it creates for updating the change log in main
(note that if this is not a patch release then the change log on main may already be up-to-date,
in which case no pull request will be created).
Expand Down