name: Release artifacts — SBOM + DSSE attestation + build provenance
on:
  release:
    types: [created]
  workflow_dispatch:
permissions:
  id-token: write
  contents: write
  packages: write
  attestations: write
jobs:
  attach:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          fetch-depth: 0

      - name: Generate SBOM (CycloneDX JSON)
        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.17.9
        with:
          format: cyclonedx-json
          output-file: ${{ github.event.repository.name }}-sbom.cdx.json

      - name: Attest build provenance
        uses: actions/attest-build-provenance@v4
        with:
          subject-path: |
            ${{ github.event.repository.name }}-sbom.cdx.json
          push-to-registry: false

      - name: Attest SBOM
        uses: actions/attest-sbom@v4
        with:
          subject-path: '${{ github.event.repository.name }}-sbom.cdx.json'
          sbom-path: '${{ github.event.repository.name }}-sbom.cdx.json'

      - name: Install cosign
        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0

      - name: Attest SBOM (DSSE/in-toto)
        env:
          COSIGN_EXPERIMENTAL: "1"
        run: |
          cosign attest-blob --yes \
            --predicate ${{ github.event.repository.name }}-sbom.cdx.json \
            --type cyclonedx \
            --output-attestation ${{ github.event.repository.name }}-attestation.intoto.jsonl \
            ${{ github.event.repository.name }}-sbom.cdx.json

      - name: Upload SBOM + attestation to release
        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        if: github.event_name == 'release'
        with:
          files: |
            ${{ github.event.repository.name }}-sbom.cdx.json
            ${{ github.event.repository.name }}-attestation.intoto.jsonl
        env:
          COSIGN_EXPERIMENTAL: "1"