name: SLSA Attestations

on:
  release:
    types: [published]
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      hash: ${{ steps.hash.outputs.hash }}
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.x'

      - name: Build package
        run: |
          pip install build
          python -m build

      - name: Generate hash
        id: hash
        run: |
          echo "hash=$(sha256sum dist/* | base64 -w0)" >> $GITHUB_OUTPUT

      - name: Upload artifacts
        uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  attest:
    needs: build
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - name: Download artifacts
        uses: actions/download-artifact@v4
        with:
          name: dist

      - name: Attest
        run: |
          for file in *; do
            gh attestation verify "$file" --owner "${{ github.repo.owner }}"
          done
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}