name: Attest Provenance

# Generates SLSA build-provenance attestations for an already-published release,
# so no image rebuild is required. Dispatch it after a release once the image
# manifest and source archives exist.
#
# Keep image attestations in GitHub's attestation API instead of pushing them
# back to registries. GHCR renders OCI fallback sha256-* attestation tags as
# package versions, which makes the package page recommend non-runtime artifacts.
# Verify with: gh attestation verify oci://<image>@<digest> -R snapotter-hq/SnapOtter

on:
  workflow_dispatch:
    inputs:
      version:
        description: "Release version without the leading v (e.g. 2.0.0)"
        required: true
        type: string
      image_digest:
        description: "Multi-arch manifest digest, sha256:... (same on both registries)"
        required: true
        type: string

permissions: {}

jobs:
  image:
    name: Attest image
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      attestations: write
      contents: read
    steps:
      - name: Attest GHCR image
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
        with:
          subject-name: ghcr.io/snapotter-hq/snapotter
          subject-digest: ${{ inputs.image_digest }}
          push-to-registry: false

      - name: Attest Docker Hub image
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
        with:
          subject-name: docker.io/snapotter/snapotter
          subject-digest: ${{ inputs.image_digest }}
          push-to-registry: false

  archives:
    name: Attest source archives
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      attestations: write
      contents: read
    steps:
      - name: Download release archives
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO: ${{ github.repository }}
          VERSION: ${{ inputs.version }}
        run: |
          gh release download "v${VERSION}" --repo "$REPO" --pattern 'snapotter-v*-linux-*.tar.gz'
          ls -l snapotter-v*-linux-*.tar.gz

      - name: Attest archives
        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
        with:
          subject-path: "snapotter-v*-linux-*.tar.gz"