name: Attest Release Binary

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Release tag (e.g. chromium-v145.0.7632.159.2)'
        required: true

jobs:
  attest:
    runs-on: ubuntu-latest
    permissions:
      id-token: write      # Sigstore OIDC
      attestations: write  # GitHub attestation API
      contents: write      # Download release assets
    steps:
      - name: Download release binaries
        run: gh release download "$RELEASE_TAG" --repo CloakHQ/cloakbrowser --pattern "cloakbrowser-*.tar.gz" --pattern "cloakbrowser-*.zip"
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ github.event.inputs.tag }}

      - name: Attest build provenance
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
        with:
          subject-path: |
            cloakbrowser-*.tar.gz
            cloakbrowser-*.zip