add release signing

eparshut · Sep 25, 2024 · c1e67a4 · c1e67a4
1 parent 08193a5
commit c1e67a4
Showing 1 changed file with 26 additions and 20 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -74,6 +74,8 @@ jobs:
   create_release:
     permissions:
       contents: write  # for actions/create-release to create a release
+      id-token: write     # for actions/attest-build-provenance to attest provenance
+      attestations: write # for actions/attest-build-provenance to attest provenance
     name: Create release
     runs-on: ubuntu-latest
     needs: [build, python_build]
@@ -104,8 +106,12 @@ jobs:
             cd build-artifacts &&
             zip -rg ../ittapi_build_${{ github.ref_name }}.zip build*/**/bin build*/**/fortran python_dist &&
             cd -
+      - name: Generate release provenance
+        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
+        with:
+          subject-path: ./ittapi_build_${{ github.ref_name }}.zip
       - name: Upload release asset
-        id: upload-release-asset 
+        id: upload-release-asset
         uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -116,22 +122,22 @@ jobs:
           asset_content_type: application/zip
 
   # upload the built wheels to PyPi
-  upload_to_pypi:
-    name: Upload the wheel files to PyPi
-    runs-on: ubuntu-latest
-    needs: [python_build, create_release]
-    steps:
-      - name: Download artifacts
-        uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
-        with:
-          pattern: build-artifacts-*
-          merge-multiple: true
-      - name: List wheel files
-        run: find -name *.whl
-      - name: Publish package distributions to PyPi
-        uses: pypa/gh-action-pypi-publish@0ab0b79471669eb3a4d647e625009c62f9f3b241 # v1.10.1
-        with:
-          password: ${{ secrets.PYPI }}
-          repository-url: https://upload.pypi.org/legacy/
-          packages-dir: python_dist
-          skip-existing: true
+  #upload_to_pypi:
+  #  name: Upload the wheel files to PyPi
+  #  runs-on: ubuntu-latest
+  #  needs: [python_build, create_release]
+  #  steps:
+  #    - name: Download artifacts
+  #      uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
+  #      with:
+  #        pattern: build-artifacts-*
+  #        merge-multiple: true
+  #    - name: List wheel files
+  #      run: find -name *.whl
+  #    - name: Publish package distributions to PyPi
+  #      uses: pypa/gh-action-pypi-publish@0ab0b79471669eb3a4d647e625009c62f9f3b241 # v1.10.1
+  #      with:
+  #        password: ${{ secrets.PYPI }}
+  #        repository-url: https://upload.pypi.org/legacy/
+  #        packages-dir: python_dist
+  #        skip-existing: true