From b35a9cda42ff634851d2ae49068fccbdba2b96f1 Mon Sep 17 00:00:00 2001
From: Lauren Tan <poteto@users.noreply.github.com>
Date: Fri, 21 Mar 2025 17:02:53 -0400
Subject: [PATCH] [ci] Add artifact attestation to build

Adds a signed build provenance attestations via https://github.com/actions/attest-build-provenance
---
 .github/workflows/runtime_build_and_test.yml | 23 ++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/.github/workflows/runtime_build_and_test.yml b/.github/workflows/runtime_build_and_test.yml
index 343c32724e..16b2cacc91 100644
--- a/.github/workflows/runtime_build_and_test.yml
+++ b/.github/workflows/runtime_build_and_test.yml
@@ -284,6 +284,11 @@ jobs:
   build_and_lint:
     name: yarn build and lint
     needs: [runtime_compiler_node_modules_cache]
+    permissions:
+      # Attestation for build: https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#generating-build-provenance-for-binaries
+      id-token: write
+      contents: read
+      attestations: write
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -332,12 +337,30 @@ jobs:
       - name: Display structure of build
         run: ls -R build
       - name: Archive build
+        id: upload_build
         uses: actions/upload-artifact@v4
         with:
           name: _build_${{ matrix.worker_id }}_${{ matrix.release_channel }}
           path: build
           if-no-files-found: error
 
+  attest_build:
+    name: Generate signed build provenance attestations
+    runs-on: ubuntu-latest
+    needs: [build_and_lint]
+    steps:
+      - name: Restore archived build
+        uses: actions/download-artifact@v4
+        with:
+          pattern: _build_*
+          path: build
+          merge-multiple: true
+      - name: Display structure of build
+        run: ls -R build
+      - uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: 'build/**/*'
+
   test_build:
     name: yarn test-build
     needs: [build_and_lint, runtime_compiler_node_modules_cache]