admin/brew
1
0
Fork 0
Code Issues Packages Projects Releases 6 Wiki Activity

Merge pull request #18555 from Homebrew/feat/installer/attestation

Browse Source 
feat: add attestation to the pkg installer
This commit is contained in:
Sean Molenaar 2024-10-13 16:12:38 +02:00 committed by GitHub
commit fcbc754c94
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
.github/workflows/pkg-installer.yml vendored
View File

@ -31,6 +31,10 @@ jobs:
TEMPORARY_KEYCHAIN_FILE: 'homebrew_installer_signing.keychain-db'
# Set to the oldest supported version of macOS
HOMEBREW_MACOS_OLDEST_SUPPORTED: '13.0'
permissions:
contents: read # for code access
attestations: write # for actions/attest-build-provenance
id-token: write # for actions/attest-build-provenance
steps:
- name: Remove existing API cache (to force update)
run: rm -rvf ~/Library/Caches/Homebrew/api
@ -124,6 +128,11 @@ jobs:
security delete-keychain "${RUNNER_TEMP}/${TEMPORARY_KEYCHAIN_FILE}"
fi
- name: Generate build provenance
uses: actions/attest-build-provenance@5e9cb68e95676991667494a6a4e59b8a2f13e1d0 # v1.3.3
with:
subject-path: Homebrew-${{ steps.homebrew-version.outputs.version }}.pkg
- name: Upload installer to GitHub Actions
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
with: