spotify_monitor/.github/workflows/release-assets.yml at main · tomballgithub/spotify_monitor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
name: Build release archives

on:
  release:
    types: [published]

permissions: {}

jobs:
  build-and-upload-assets:
    name: Build zip and tar.gz and upload to release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      # Signing the provenance attestation for the published archives
      id-token: write
      attestations: write

    steps:
      - name: Check out source
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Build archives from release tag
        shell: bash
        # The tag reaches the script through the environment so it cannot be interpreted as shell syntax
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |
          set -euo pipefail
          TAG="$RELEASE_TAG"

          if [[ ! "$TAG" =~ ^[A-Za-z0-9._-]+$ ]]; then
            echo "Refusing unsafe release tag: $TAG" >&2
            exit 1
          fi

          PREFIX="spotify_monitor_${TAG}"

          git archive --format=zip --output "${PREFIX}.zip" "${TAG}"
          git archive --format=tar.gz --output "${PREFIX}.tar.gz" "${TAG}"

          sha256sum "${PREFIX}.zip" "${PREFIX}.tar.gz" > "${PREFIX}_SHA256SUMS.txt"

          ls -lh "${PREFIX}.zip" "${PREFIX}.tar.gz"
          cat "${PREFIX}_SHA256SUMS.txt"

      # Lets anyone confirm the archives were built by this workflow from this tag:
      #     gh attestation verify spotify_monitor_<tag>.zip --repo misiektoja/spotify_monitor
      - name: Attest the archives' build provenance
        id: attest
        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
        with:
          subject-path: |
            spotify_monitor_${{ github.event.release.tag_name }}.zip
            spotify_monitor_${{ github.event.release.tag_name }}.tar.gz

      # Publishing the bundle alongside the archives lets offline verifiers check provenance
      # without calling the attestations API, and it is the form automated scanners look for
      - name: Stage the provenance bundle as a release asset
        shell: bash
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
          BUNDLE_PATH: ${{ steps.attest.outputs.bundle-path }}
        run: |
          set -euo pipefail
          cp "$BUNDLE_PATH" "spotify_monitor_${RELEASE_TAG}.intoto.jsonl"
          ls -lh "spotify_monitor_${RELEASE_TAG}.intoto.jsonl"

      - name: Upload archives to GitHub Release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
        with:
          files: |
            spotify_monitor_${{ github.event.release.tag_name }}.zip
            spotify_monitor_${{ github.event.release.tag_name }}.tar.gz
            spotify_monitor_${{ github.event.release.tag_name }}_SHA256SUMS.txt
            spotify_monitor_${{ github.event.release.tag_name }}.intoto.jsonl
          fail_on_unmatched_files: true
          overwrite_files: true