Add provenance to Github build

thefightagainstmalware · Jan 12, 2024 · b3e54bb · b3e54bb
1 parent bf915a7
commit b3e54bb
Showing 1 changed file with 10 additions and 5 deletions.
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
@@ -12,12 +12,12 @@ on:
   pull_request:
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   build:
-
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
     runs-on: ubuntu-latest
 
     steps:
@@ -51,7 +51,12 @@ jobs:
       run: gpg --detach-sign -a ./build/libs/*.jar
       env:
         GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
-
+
+    - name: Generate provenance information
+      uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+      with:
+        artifact-list: ./build/libs/*.jar
+
     - name: Upload a Build Artifact
       uses: actions/[email protected]
       with: