chore: attest build provenance

Committed via https://github.com/asottile/all-repos
browniebroke · Aug 8, 2024 · cfbced3 · cfbced3
1 parent 13b45d3
commit cfbced3
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/project/.github/workflows/ci.yml.jinja b/project/.github/workflows/ci.yml.jinja
@@ -101,6 +101,7 @@ jobs:
     concurrency: release
     permissions:
       id-token: write
+      attestations: write
       contents: write
 
     steps:
@@ -124,6 +125,12 @@ jobs:
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Attest build build provenance
+        uses: actions/attest-build-provenance@v1
+        if: steps.release.outputs.released == 'true'
+        with:
+          subject-path: "dist/*"
+
       - name: Publish package distributions to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         if: steps.release.outputs.released == 'true'