Generate SLSA3+ Provenance

Signed-off-by: Stefan Prodan <[email protected]>
letenkov · May 16, 2023 · b38415a · b38415a
1 parent 6400f1e
commit b38415a
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -45,6 +45,10 @@ jobs:
           set -euo pipefail
 
           hashes=$(echo $ARTIFACTS | jq --raw-output '.[] | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {digest} + {name} | join("  ") | sub("^sha256:";"")' | base64 -w0)
+          if test "$hashes" = ""; then # goreleaser < v1.13.0
+            checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
+            hashes=$(cat $checksum_file | base64 -w0)
+          fi
           echo "hashes=$hashes" >> $GITHUB_OUTPUT
 
   provenance: