security-attestation.yml•2.61 kB
name: "Security: Artifact Attestation"
on:
release:
types: [published]
workflow_dispatch:
inputs:
tag:
description: "Release tag to generate attestation for"
required: true
type: string
permissions:
contents: read
jobs:
build-and-attest:
name: "Build and Attest"
runs-on: ubuntu-latest
permissions:
contents: write
attestations: write
id-token: write
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
with:
egress-policy: audit
- name: Checkout code
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
ref: ${{ github.event.release.tag_name || inputs.tag }}
- name: Setup PHP
uses: shivammathur/setup-php@ec406be512d7077f68eed36e63f4d91bc006edc4 # 2.35.4
with:
php-version: "8.3"
tools: composer
- name: Install dependencies
run: composer install --no-dev --optimize-autoloader
- name: Create release artifacts
run: |
mkdir -p /tmp/artifacts
tar --sort=name \
--mtime="@${SOURCE_DATE_EPOCH:-$(git log -1 --pretty=%ct)}" \
--owner=0 --group=0 --numeric-owner \
-czf /tmp/artifacts/openfga-mcp-${{ github.event.release.tag_name || inputs.tag }}.tar.gz \
--exclude='.git*' \
--exclude='tests' \
--exclude='*.test' \
--exclude='.github' \
.
mv /tmp/artifacts/*.tar.gz .
- name: Generate artifact attestation
id: attest
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
with:
subject-path: "openfga-mcp-*.tar.gz"
show-summary: true # Default is true, but being explicit
- name: Display attestation info
if: steps.attest.outputs.attestation-url != ''
run: |
echo "Attestation created successfully!"
echo "Attestation ID: ${{ steps.attest.outputs.attestation-id }}"
echo "Attestation URL: ${{ steps.attest.outputs.attestation-url }}"
- name: Upload artifacts to release
env:
GH_TOKEN: ${{ github.token }}
run: |
TAG="${{ github.event.release.tag_name || inputs.tag }}"
echo "Uploading artifacts to release $TAG"
gh release upload "$TAG" openfga-mcp-*.tar.gz \
--repo "${{ github.repository }}" \
--clobber