From 425d6d3aaa0d4b6127d438dcfd9184e911b34a21 Mon Sep 17 00:00:00 2001
From: axtloss <axtlos@getcryst.al>
Date: Wed, 9 Oct 2024 09:53:25 +0200
Subject: [PATCH] feat: Add workflow to release source tarball with vendored
 deps

---
 .github/workflows/vendored-release.yml | 41 ++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 .github/workflows/vendored-release.yml

diff --git a/.github/workflows/vendored-release.yml b/.github/workflows/vendored-release.yml
new file mode 100644
index 0000000..1047dce
--- /dev/null
+++ b/.github/workflows/vendored-release.yml
@@ -0,0 +1,41 @@
+name: Vendored Source tarball
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # to upload assets to releases
+      attestations: write # to upload assets attestation for build provenance
+      id-token: write # grant additional permission to attestation action to mint the OIDC token permission
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: 1.22
+
+    - name: Vendor dependencies
+      run: |
+        go get
+        go mod vendor
+        tar cvf vib-vendored-deps.tar.xz *
+
+    - name: Upload a Release Asset
+      if: github.repository == 'Vanilla-OS/Vib'
+      uses: softprops/action-gh-release@v2
+      with:
+        files: vib-vendored-deps.tar.xz
+
+    - name: Attest generated files
+      if: github.repository == 'Vanilla-OS/Vib'
+      id: attest
+      uses: actions/attest-build-provenance@v1
+      with:
+        subject-path: 'vib-vendored-deps.tar.xz'