Add provenance attestations.

python-websockets · Aug 28, 2024 · 157f790 · 157f790
1 parent 62d70f4
commit 157f790
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -72,6 +72,7 @@ jobs:
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
     permissions:
       id-token: write
+      attestations: write
       contents: write
     steps:
       - name: Download artifacts
@@ -80,6 +81,10 @@ jobs:
           pattern: dist-*
           merge-multiple: true
           path: dist
+      - name: Attest provenance
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: dist/*
       - name: Upload to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
       - name: Create GitHub release