add slsa-verifier step to release workflow for build verification

2026-08-20 01:53:35 +02:00 · 2026-06-13 20:02:31 +02:00
parent 37311c343a
commit b27fc56bab
1 changed files with 10 additions and 0 deletions
@@ -111,6 +111,16 @@ jobs:
        uses: actions/download-artifact@v4
        with:
          path: builds/
+      - name: Verify SLSA provenance
+        run: |
+          for file in builds/*/*.tar.gz builds/*/*.zip builds/*/*.cdx.json; do
+            [ -f "$file" ] || continue
+            slsa-verifier verify-artifact \
+              --provenance-path builds/*/*.intoto.jsonl \
+              --source-uri github.com/forkless/NotAlterra \
+              --source-tag "${{ github.ref_name }}" \
+              "$file"
+          done
      - name: Create draft release
        uses: softprops/action-gh-release@v2
        with: