Step 2: add attestation

PHPCSStandards · Jul 23, 2024 · ff588bf · ff588bf
1 parent cce3fa3
commit ff588bf
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -44,6 +44,17 @@ jobs:
       - name: Build the phar
         run: php scripts/build-phar.php
 
+      # Provide provenance for generated binaries.
+      # Only attests the build artifacts which will be used in the published releases as per the guidelines in "what to attest".
+      # https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
+      - name: Generate artifact attestations
+        #if: github.ref_type == 'tag'
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: |
+            ${{ github.workspace }}/phpcs.phar
+            ${{ github.workspace }}/phpcbf.phar
+
       - name: Upload the PHPCS phar
         uses: actions/upload-artifact@v4
         with: