- uses: actions/attest@v2
  with:
    # Path to the artifact serving as the subject of the attestation. Must
    # specify exactly one of "subject-path" or "subject-digest". May contain
    # a glob pattern or list of paths (total subject count cannot exceed 1024).
    subject-path:

    # SHA256 digest of the subject for the attestation. Must be in the form
    # "sha256:hex_digest" (e.g. "sha256:abc123..."). Must specify exactly one
    # of "subject-path" or "subject-digest".
    subject-digest:

    # Subject name as it should appear in the attestation. Required unless
    # "subject-path" is specified, in which case it will be inferred from the
    # path.
    subject-name:

    # URI identifying the type of the predicate.
    predicate-type:

    # String containing the value for the attestation predicate. String length
    # cannot exceed 16MB. Must supply exactly one of "predicate-path" or
    # "predicate".
    predicate:

    # Path to the file which contains the content for the attestation predicate.
    # File size cannot exceed 16MB. Must supply exactly one of "predicate-path"
    # or "predicate".
    predicate-path:

    # Whether to push the attestation to the image registry. Requires that the
    # "subject-name" parameter specify the fully-qualified image name and that
    # the "subject-digest" parameter be specified. Defaults to false.
    push-to-registry:

    # Whether to attach a list of generated attestations to the workflow run
    # summary page. Defaults to true.
    show-summary:

    # The GitHub token used to make authenticated API requests. Default is
    # ${{ github.token }}
    github-token:

name: build-attest

on:
  workflow_dispatch:

jobs:
  build:
    permissions:
      id-token: write
      contents: read
      attestations: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Build artifact
        run: make my-app
      - name: Attest
        uses: actions/attest@v2
        with:
          subject-path: '${{ github.workspace }}/my-app'
          predicate-type: 'https://example.com/predicate/v1'
          predicate: '{}'

- uses: actions/attest@v2
  with:
    subject-path: 'dist/**/my-bin-*'
    predicate-type: 'https://example.com/predicate/v1'
    predicate: '{}'

- uses: actions/attest@v2
  with:
    subject-path: 'dist/foo, dist/bar'

- uses: actions/attest@v2
  with:
    subject-path: |
      dist/foo
      dist/bar

name: build-attested-image

on:
  push:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      packages: write
      contents: read
      attestations: write
    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: ${{ github.repository }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push image
        id: push
        uses: docker/[email protected]
        with:
          context: .
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
      - name: Attest
        uses: actions/attest@v2
        id: attest
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          subject-digest: ${{ steps.push.outputs.digest }}
          predicate-type: 'https://in-toto.io/attestation/release/v0.1'
          predicate: '{"purl":"pkg:oci/..."}'
          push-to-registry: true