Generate attestation + refactor workflows (#1039)

.github/workflows/build.yaml

@@ -1,10 +1,12 @@
 name: Build
 
 on:
-  create:
+  # On new commits to main:
   push:
     branches:
       - main
+
+  # On pull requests:
   pull_request:
     branches:
       - main
@@ -152,144 +154,3 @@ jobs:
           flags: ${{ runner.os }}
           name: ${{ runner.os }}-coverage
           files: ./build/coverage.xml
-
-  # Create a release on new v* tags
-  release:
-    needs:
-      - test_cmake
-      - test_bazel
-    if: ${{ github.event_name == 'create' && startsWith(github.ref, 'refs/tags/v') }}
-    name: "Create release"
-    runs-on: ubuntu-latest
-    outputs:
-      upload_url: ${{ steps.create_release.outputs.upload_url }}
-    steps:
-      - name: "Create release"
-        uses: softprops/action-gh-release@v1
-        id: create_release
-        with:
-          draft: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  # Build artifact for the release
-  package_compiled:
-    name: "Build packages"
-    needs: release
-    strategy:
-      matrix:
-        include:
-          - os: ubuntu-latest
-            asset_path: build/ftxui*Linux*
-          - os: macos-latest
-            asset_path: build/ftxui*Darwin*
-          - os: windows-latest
-            asset_path: build/ftxui*Win64*
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Get number of CPU cores
-        uses: SimenB/github-actions-cpu-cores@v1
-        id: cpu-cores
-
-      - name: "Checkout repository"
-        uses: actions/checkout@v3
-
-      - name: "Install cmake"
-        uses: lukka/get-cmake@latest
-
-      - name: "Build packages"
-        run: >
-          mkdir build;
-          cd build;
-          cmake ..
-          -DCMAKE_BUILD_TYPE=Release
-          -DCMAKE_BUILD_PARALLEL_LEVEL=${{ steps.cpu-cores.outputs.count }}
-          -DFTXUI_BUILD_DOCS=OFF
-          -DFTXUI_BUILD_EXAMPLES=OFF
-          -DFTXUI_BUILD_TESTS=OFF
-          -DFTXUI_BUILD_TESTS_FUZZER=OFF
-          -DFTXUI_ENABLE_INSTALL=ON
-          -DFTXUI_DEV_WARNINGS=ON ;
-          cmake --build . --target package;
-
-      - uses: shogo82148/actions-upload-release-asset@v1
-        with:
-          upload_url: ${{ needs.release.outputs.upload_url }}
-          asset_path: ${{ matrix.asset_path }}
-          overwrite: true
-
-  # Build "source" artifact for the release. This is the same as the github
-  # "source" archive, but with a stable URL. This is useful for the Bazel
-  # Central Repository.
-  package_source:
-    name: "Build source package"
-    needs: release
-    runs-on: ubuntu-latest
-    steps:
-      - name: "Checkout repository"
-        uses: actions/checkout@v3
-
-      - name: "Create source package"
-        run: >
-          git archive --format=tar.gz -o source.tar.gz HEAD
-
-      - name: "Upload source package"
-        uses: shogo82148/actions-upload-release-asset@v1
-        with:
-          upload_url: ${{ needs.release.outputs.upload_url }}
-          asset_path: source.tar.gz
-          overwrite: true
-
-  
-  documentation:
-    if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
-    steps:
-      - name: "Checkout repository"
-        uses: actions/checkout@v3
-
-      - name: "Install cmake"
-        uses: lukka/get-cmake@latest
-
-      - name: "Install emsdk"
-        uses: mymindstorm/setup-emsdk@v7
-
-      - name: "Install Doxygen/Graphviz"
-        run: >
-          sudo apt-get update;
-          sudo apt-get install doxygen graphviz;
-
-      - name: "Build documentation"
-        run: >
-          mkdir build;
-          cd build;
-          emcmake cmake ..
-          -DCMAKE_BUILD_TYPE=Release
-          -DFTXUI_BUILD_DOCS=ON
-          -DFTXUI_BUILD_EXAMPLES=ON
-          -DFTXUI_BUILD_TESTS=OFF
-          -DFTXUI_BUILD_TESTS_FUZZER=OFF
-          -DFTXUI_ENABLE_INSTALL=OFF
-          -DFTXUI_DEV_WARNINGS=ON ;
-          cmake --build . --target doc;
-          cmake --build . ;
-          rsync -amv
-          --include='*/'
-          --include='*.html'
-          --include='*.css'
-          --include='*.mjs'
-          --include='*.js'
-          --include='*.wasm'
-          --exclude='*'
-          examples
-          doc/doxygen/html;
-
-      - name: "Deploy"
-        uses: peaceiris/actions-gh-pages@v3
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: build/doc/doxygen/html/
-          enable_jekyll: false
-          allow_empty_commit: false
-          force_orphan: true
-          publish_branch: gh-pages

.github/workflows/documentation.yaml

@@ -0,0 +1,60 @@
+name: Documentation
+
+on:
+  # On new commits to main:
+  push:
+    branches:
+      - main
+
+jobs:
+  documentation:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@v3
+
+      - name: "Install cmake"
+        uses: lukka/get-cmake@latest
+
+      - name: "Install emsdk"
+        uses: mymindstorm/setup-emsdk@v7
+
+      - name: "Install Doxygen/Graphviz"
+        run: >
+          sudo apt-get update;
+          sudo apt-get install doxygen graphviz;
+
+      - name: "Build documentation"
+        run: >
+          mkdir build;
+          cd build;
+          emcmake cmake ..
+          -DCMAKE_BUILD_TYPE=Release
+          -DFTXUI_BUILD_DOCS=ON
+          -DFTXUI_BUILD_EXAMPLES=ON
+          -DFTXUI_BUILD_TESTS=OFF
+          -DFTXUI_BUILD_TESTS_FUZZER=OFF
+          -DFTXUI_ENABLE_INSTALL=OFF
+          -DFTXUI_DEV_WARNINGS=ON ;
+          cmake --build . --target doc;
+          cmake --build . ;
+          rsync -amv
+          --include='*/'
+          --include='*.html'
+          --include='*.css'
+          --include='*.mjs'
+          --include='*.js'
+          --include='*.wasm'
+          --exclude='*'
+          examples
+          doc/doxygen/html;
+
+      - name: "Deploy"
+        uses: peaceiris/actions-gh-pages@v3
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: build/doc/doxygen/html/
+          enable_jekyll: false
+          allow_empty_commit: false
+          force_orphan: true
+          publish_branch: gh-pages

.github/workflows/publish.yaml

@@ -1,3 +1,5 @@
+name: "Publish to Bazel Central Registry"
+
 on:
   # On manual trigger:
   workflow_dispatch:
@@ -6,6 +8,17 @@ on:
         required: true
         type: string
 
+  # Called from the release workflow:
+  workflow_call:
+    inputs:
+      tag_name:
+        required: true
+        type: string
+    secrets:
+      PUBLISH_TOKEN:
+        required: true
+        type: string
+
 jobs:    
   publish:
     uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v0.0.4

.github/workflows/release.yaml

@@ -0,0 +1,128 @@
+name: Release
+
+on:
+  # On push to a tag:
+  push:
+    tags:
+      - 'v*'
+
+  # On manual trigger:
+  workflow_dispatch:
+
+permissions:
+  # Needed to mint attestations
+  id-token: write
+  attestations: write
+
+jobs:
+  release:
+    name: "Create release"
+    runs-on: ubuntu-latest
+    outputs:
+      upload_url: ${{ steps.create_release.outputs.upload_url }}
+    steps:
+      - name: "Create release"
+        uses: softprops/action-gh-release@v1
+        id: create_release
+        with:
+          draft: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  # Build artifact for the release
+  package_compiled:
+    name: "Build packages"
+    needs: release
+    strategy:
+      matrix:
+        include:
+          - os: ubuntu-latest
+            asset_path: build/ftxui*Linux*
+          - os: macos-latest
+            asset_path: build/ftxui*Darwin*
+          - os: windows-latest
+            asset_path: build/ftxui*Win64*
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Get number of CPU cores
+        uses: SimenB/github-actions-cpu-cores@v1
+        id: cpu-cores
+
+      - name: "Checkout repository"
+        uses: actions/checkout@v3
+
+      - name: "Install cmake"
+        uses: lukka/get-cmake@latest
+
+      - name: "Build packages"
+        run: >
+          mkdir build;
+          cd build;
+          cmake ..
+          -DCMAKE_BUILD_TYPE=Release
+          -DCMAKE_BUILD_PARALLEL_LEVEL=${{ steps.cpu-cores.outputs.count }}
+          -DFTXUI_BUILD_DOCS=OFF
+          -DFTXUI_BUILD_EXAMPLES=OFF
+          -DFTXUI_BUILD_TESTS=OFF
+          -DFTXUI_BUILD_TESTS_FUZZER=OFF
+          -DFTXUI_ENABLE_INSTALL=ON
+          -DFTXUI_DEV_WARNINGS=ON ;
+          cmake --build . --target package;
+
+      - uses: shogo82148/actions-upload-release-asset@v1
+        with:
+          upload_url: ${{ needs.release.outputs.upload_url }}
+          asset_path: ${{ matrix.asset_path }}
+          overwrite: true
+
+  # Build "source" artifact for the release. This is the same as the github
+  # "source" archive, but with a stable URL. This is useful for the Bazel
+  # Central Repository.
+  package_source:
+    name: "Build source package"
+    needs: release
+    runs-on: ubuntu-latest
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@v3
+
+      - name: "Create source package"
+        run: >
+          git archive --format=tar.gz -o source.tar.gz HEAD
+
+      - name: Generate source attestation
+        id: attest_source
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: source.tar.gz
+
+      - name: Write source.intoto.jsonl
+        run: 
+          jq --compact-output < "${{ steps.attest_source.outputs.bundle-path }}" \
+            > source.tar.gz.intoto.jsonl
+
+      - name: "Upload source package"
+        uses: shogo82148/actions-upload-release-asset@v1
+        with:
+          upload_url: ${{ needs.release.outputs.upload_url }}
+          asset_path: source.tar.gz
+          overwrite: true
+
+      - name: "Upload source attestation"
+        uses: shogo82148/actions-upload-release-asset@v1
+        with:
+          upload_url: ${{ needs.release.outputs.upload_url }}
+          asset_path: source.tar.gz.intoto.jsonl
+          overwrite: true
+
+  # Publish to Bazel Central Registry.
+  # This call the .github/workflows/publish.yaml workflow.
+  publish_to_bazel_central_registry:
+    name: "Publish to Bazel Central Registry"
+    needs: package_source
+    uses: ./.github/workflows/publish.yaml
+    with:
+      tag_name: ${{ github.ref }}
+    secrets:
+      PUBLISH_TOKEN: ${{ secrets.PUBLISH_TOKEN }}
+