Merge pull request #9 from TheMaxMur/develop #7
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: AGPL-3.0-only | |
| # Copyright (C) 2026 RS-Key contributors | |
| # Cut a release from a pushed `v*` tag. | |
| # | |
| # This is a thin CALLER: it only resolves the tag and invokes the reusable | |
| # `release-build.yml`, which does all the building, attesting and publishing. | |
| # The split is deliberate — running the build + provenance inside a reusable | |
| # workflow is what earns **SLSA v1 Build Level 3** (the provenance binds to the | |
| # reusable workflow's own identity, so consumers can prove which trusted builder | |
| # produced each artifact, not merely that "something in this repo" did). See the | |
| # header of release-build.yml and docs/supply-chain.md. | |
| # | |
| # Permissions are granted HERE and flow down to the reusable workflow (a called | |
| # workflow's token can be no broader than its caller's). | |
| name: release | |
| on: | |
| push: | |
| tags: ["v*"] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "tag to (re)build a release for, e.g. v0.1.0" | |
| required: true | |
| concurrency: | |
| group: release-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| release: | |
| permissions: | |
| contents: write # create the release + upload assets | |
| id-token: write # keyless cosign + the attestation's Fulcio OIDC token | |
| attestations: write # GitHub build-provenance attestation (immutable-safe) | |
| uses: ./.github/workflows/release-build.yml | |
| with: | |
| tag: ${{ github.event.inputs.tag || github.ref_name }} |