tag-to-release.yaml

name: tag to release
on:
  push:
    tags:
    - v*
permissions: {}
jobs:
  release:
    permissions:
      # create release
      contents: write
      # required by attest-build-provenance
      id-token: write
      attestations: write
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
      with:
        fetch-depth: 0
    - name: Create release
      run: |
        gh release create "${{ github.ref_name }}" --verify-tag --generate-notes
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - name: Attach SBOM to release in SPDX JSON format
      # https://docs.github.com/en/rest/dependency-graph/sboms?apiVersion=2022-11-28
      run: |
        gh api \
          -H "Accept: application/vnd.github+json" \
          -H "X-GitHub-Api-Version: 2022-11-28" \
          /repos/${{ github.repository }}/dependency-graph/sbom > sbom.spdx.json
        gh release upload "${{ github.ref_name }}" sbom.spdx.json
      env:
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    - uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
      with:
        subject-path: sbom.spdx.json