slsa

.github/workflows/package.yml

@@ -0,0 +1,70 @@
+name: Build Release Package
+on:
+  push:
+  pull_request:
+
+concurrency:
+  group: ${{ github.ref }}-build-release-package
+  cancel-in-progress: true
+
+env:
+  TEST_FILTER: "--gtest_filter=-*LiveSearchTXT*:*LiveSearchANY*"
+  MAKE: make
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+      version: ${{ steps.gettag.outputs.version }}
+    name: "build"
+    steps:
+      - name: Install packages
+        uses: awalsh128/cache-apt-pkgs-action@latest
+        with:
+          packages: autoconf automake libtool g++ libgmock-dev pkg-config gdb
+          version: 1.0
+      - name: Checkout c-ares
+        uses: actions/checkout@v4
+      - name: Get Tag version
+        id: gettag
+        run: |
+          version=`echo ${GITHUB_REF} | grep '^refs/tags/v' | sed -e 's|^refs/tags/v\(.*\)|\1|'`
+          if [ "$version" = "" ] ; then
+            version="prerelease"
+          fi
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+      - name: "build c-ares tarball"
+        run: |
+          autoreconf -fi
+          ./configure
+          make dist
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: "c-ares-src-tarball"
+          path: 'c-ares-*.tar.gz'
+          if-no-files-found: error
+          overwrite: true
+      - name: Upload Release
+        uses: softprops/action-gh-release@v2
+        if: startsWith(github.ref, 'refs/tags/')
+        with:
+          files: c-ares-${{ steps.version.outputs.version }}.tar.gz'
+      - name: Generate subject
+        id: hash
+        run: |
+          set -euo pipefail
+          echo "hashes=$(sha256sum c-ares-*.tar.gz | base64 -w0)" >> "$GITHUB_OUTPUT"
+
+  provenance:
+    needs: [build]
+    permissions:
+      actions: read # To read the workflow path.
+      id-token: write # To sign the provenance.
+      contents: write # To add assets to a release.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+    with:
+      base64-subjects: "${{ needs.build.outputs.hashes }}"
+      upload-assets: ${{ startsWith(github.ref, 'refs/tags/') }}
+      provenance-name: "c-ares-${{ needs.build.outputs.version }}.intoto.jsonl"