@@ -21,6 +21,8 @@ jobs:
21 runs-on: ubuntu-latest
21 runs-on: ubuntu-latest
22 permissions:
22 permissions:
23 contents: write # required to push the tag and create the release
23 contents: write # required to push the tag and create the release
24+ id-token: write # required for OIDC so GitHub can sign the attestation
25+ attestations: write # required to publish the attestation record
25 - uses: actions/checkout@v4
27 - uses: actions/checkout@v4
@@ -73,6 +75,17 @@ jobs:
73 APK="$(find app/build/outputs/apk -name '*.apk' | head -n1)"
75 APK="$(find app/build/outputs/apk -name '*.apk' | head -n1)"
74 cp "$APK" "staging/opencode-${{ steps.version.outputs.version }}.apk"
76 cp "$APK" "staging/opencode-${{ steps.version.outputs.version }}.apk"
78+ # Generate a signed build-provenance attestation for the staged APK and
79+ # store it in GitHub's artifact attestation store, keyed by the file's
80+ # digest. Anyone can later verify the APK's origin/provenance with
81+ # `gh attestation verify` -- its repository & workflow. Run *after*
82+ # staging and *before* the release is published so the attested subject
83+ # is byte-identical to the artifact attached to the release.
84+ - name: Attest build provenance
85+ uses: actions/attest-build-provenance@v2
87+ subject-path: staging/*.apk
76 - name: Create release
89 - name: Create release
77 uses: softprops/action-gh-release@v2
90 uses: softprops/action-gh-release@v2