name: Attest Release Binary

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g. chromium-v145.0.7632.159.2)'
        required: true

jobs:
  attest:
    runs-on: ubuntu-latest
    permissions:
      id-token: write      # Sigstore OIDC
      attestations: write  # GitHub attestation API
      contents: write      # Download release assets
    steps:
      - name: Download release binaries
        run: gh release download ${{ github.event.inputs.tag }} --repo CloakHQ/cloakbrowser --pattern "cloakbrowser-*.tar.gz" --pattern "cloakbrowser-*.zip"
        env:
          GH_TOKEN: ${{ github.token }}

      - name: Attest build provenance
        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be  # v2
        with:
          subject-path: |
            cloakbrowser-*.tar.gz
            cloakbrowser-*.zip