[ci] Add artifact attestation to build (#32711)
Adds a signed build provenance attestations via https://github.com/actions/attest-build-provenance --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/facebook/react/pull/32711). * #32729 * #32728 * __->__ #32711
lauren committed
Mar 24, 2025 at 18:13 UTC
07276b8682059cd310cedf574c7f3ecddce68f5c
1 file changed
+9
.github/workflows/runtime_build_and_test.yml
+9
@@ -426,6 +426,10 @@ jobs:
426
process_artifacts_combined:
427
name: Process artifacts combined
428
needs: [build_and_lint, runtime_node_modules_cache]
429
+ permissions:
430
+ # https://github.com/actions/attest-build-provenance
431
+ id-token: write
432
+ attestations: write
433
runs-on: ubuntu-latest
434
steps:
435
- uses: actions/checkout@v4
@@ -468,6 +472,7 @@ jobs:
472
# TODO: Migrate scripts to use `build` directory instead of `build2`
473
- run: cp ./build.tgz ./build2.tgz
474
- name: Archive build artifacts
475
+ id: upload_artifacts_combined
476
uses: actions/upload-artifact@v4
477
with:
478
name: artifacts_combined
@@ -475,6 +480,10 @@ jobs:
480
./build.tgz
481
./build2.tgz
482
if-no-files-found: error
483
+ - uses: actions/attest-build-provenance@v2
484
+ with:
485
+ subject-name: artifacts_combined.zip
486
+ subject-digest: sha256:${{ steps.upload_artifacts_combined.outputs.artifact-digest }}
487
488
check_error_codes:
489
name: Search build artifacts for unminified errors