@@ -9,6 +9,10 @@ on:
99jobs:
1010 build:
1111 runs-on: macos-15
12+ permissions:
13+ id-token: write
14+ attestations: write
15+ contents: read
1216 strategy:
1317 matrix:
1418 include:
@@ -69,6 +73,11 @@ jobs:
6973 exit 1
7074 fi
7175
76+ - name: Attest artifact
77+ uses: actions/attest-build-provenance@v2
78+ with:
79+ subject-path: ParseableViewer-${{ matrix.arch }}.zip
80+
7281 - name: Upload artifact
7382 uses: actions/upload-artifact@v4
7483 with:
@@ -78,6 +87,10 @@ jobs:
7887 create-universal:
7988 needs: build
8089 runs-on: macos-15
90+ permissions:
91+ id-token: write
92+ attestations: write
93+ contents: read
8194 steps:
8295 - name: Checkout
8396 uses: actions/checkout@v4
@@ -125,6 +138,11 @@ jobs:
125138 cd universal_app
126139 zip -r -y "../ParseableViewer-universal.zip" "Parseable Viewer.app"
127140
141+ - name: Attest universal artifact
142+ uses: actions/attest-build-provenance@v2
143+ with:
144+ subject-path: ParseableViewer-universal.zip
145+
128146 - name: Upload universal artifact
129147 uses: actions/upload-artifact@v4
130148 with:
@@ -140,6 +158,8 @@ jobs:
140158 if: github.event_name == 'push'
141159 permissions:
142160 contents: write
161+ id-token: write
162+ attestations: write
143163 steps:
144164 - name: Checkout
145165 uses: actions/checkout@v4
@@ -155,6 +175,14 @@ jobs:
155175 with:
156176 path: artifacts
157177
178+ - name: Attest release artifacts
179+ uses: actions/attest-build-provenance@v2
180+ with:
181+ subject-path: |
182+ artifacts/ParseableViewer-arm64/ParseableViewer-arm64.zip
183+ artifacts/ParseableViewer-x86_64/ParseableViewer-x86_64.zip
184+ artifacts/ParseableViewer-universal/ParseableViewer-universal.zip
185+
158186 - name: Create release
159187 uses: softprops/action-gh-release@v2
160188 with: