Add GitHub attestation build provenance for NuGet packages

jedisct1 · May 2, 2024 · b6d2cf8 · b6d2cf8
1 parent b6ed54f
commit b6d2cf8
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/.github/workflows/dotnet-core.yml b/.github/workflows/dotnet-core.yml
@@ -6,6 +6,11 @@ on:
       - stable
       - next
 
+permissions:
+  id-token: write
+  attestations: write
+  contents: read
+
 jobs:
   build-windows-msvc:
     runs-on: windows-latest
@@ -221,6 +226,11 @@ jobs:
           name: nuget-package
           path: .libsodium-pack/bin/Release/*.nupkg
 
+      - name: Attest Build Provenance
+        uses: actions/attest-build-provenance@897ed5eab6ed058a474202017ada7f40bfa52940
+        with:
+         subject-path: .libsodium-pack/bin/Release/*.nupkg
+
   build-test-binaries:
     runs-on: ubuntu-latest
     needs:
@@ -329,4 +339,4 @@ jobs:
       - name: Run ${{ matrix.arch }}
         run: |
           chmod +x .libsodium-builds/linux-${{ matrix.arch }}/Tests
-          env LD_LIBRARY_PATH=${{ matrix.libs }} .libsodium-builds/linux-${{ matrix.arch }}/Tests
+          env LD_LIBRARY_PATH=${{ matrix.libs }} .libsodium-builds/linux-${{ matrix.arch }}/Tests