SLSA Build L2からL3へ

name: reusable-build

on:
  workflow_call:

permissions:
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read # id-token: writeを持たせない
    outputs:
      digest: ${{ steps.hash.outputs.digest }}

    steps:
      - uses: actions/checkout@<sha>
        with:
          persist-credentials: false

      - uses: actions/setup-go@<sha>
        with:
          go-version: '1.24'
          cache: false # 信頼できないワークフローのキャッシュを読まないようにキャッシュを切る

      - name: Build
        run: |
          mkdir -p dist
          go build -o dist/slsa-workshop main.go

      - name: Digest
        id: hash
        run: echo "digest=sha256:$(sha256sum dist/slsa-workshop | cut -d' ' -f1)" >> "$GITHUB_OUTPUT"

      - name: Upload binary
        uses: actions/upload-artifact@<sha>
        with:
          name: slsa-workshop
          path: dist/slsa-workshop

  attest:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      attestations: write
      artifact-metadata: write

    steps:
      - name: Generate provenance
        uses: actions/attest@<sha>
        with:
          subject-name: slsa-workshop
          subject-digest: ${{ needs.build.outputs.digest }}

name: build-and-attest

# 省略
permissions:
  contents: read

jobs:
  build:
    permissions:
      contents: read
      id-token: write
      attestations: write
      artifact-metadata: write
    uses: ./.github/workflows/reusable-build.yml

jobs:
  build:
    permissions:
      contents: read
      id-token: write
      attestations: write
      artifact-metadata: write
    uses: <別リポジトリ>/.github/workflows/go-build.yml@<コミットSHA>