feat: implement attesting of multiple binary artefacts

Author: smlx

.github/workflows/build.yaml

@@ -14,6 +14,7 @@ jobs:
       matrix:
         binary:
         - go-cli-github
+        - another-binary
     steps:
     - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
       with:

.github/workflows/release.yaml

@@ -63,20 +63,31 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         GITHUB_SBOM_PATH: ./sbom.spdx.json
+    # attest archives
+    - uses: actions/attest-build-provenance@49df96e17e918a15956db358890b08e61c704919 # v1.2.0
+      with:
+        subject-path: "dist/*.tar.gz"
     # parse artifacts to the format required for image attestation
     - run: |
-        echo "digest=$(echo "$ARTIFACTS" | jq -r '.[]|select(.type=="Docker Manifest")|select(.name|test(":v"))|.extra.Digest')" >> "$GITHUB_OUTPUT"
-        echo "name=$(echo "$ARTIFACTS" | jq -r '.[]|select(.type=="Docker Manifest")|select(.name|test(":v"))|.name|split(":")[0]')" >> "$GITHUB_OUTPUT"
-      id: image_metadata
+        echo "digest=$(echo "$ARTIFACTS" | jq -r '.[]|select(.type=="Docker Manifest")|select(.name|test("go-cli-github:v"))|.extra.Digest')" >> "$GITHUB_OUTPUT"
+        echo "name=$(echo "$ARTIFACTS" | jq -r '.[]|select(.type=="Docker Manifest")|select(.name|test("go-cli-github:v"))|.name|split(":")[0]')" >> "$GITHUB_OUTPUT"
+      id: image_metadata_go_cli_github
       env:
         ARTIFACTS: ${{steps.goreleaser.outputs.artifacts}}
-    # attest archives
+    - run: |
+        echo "digest=$(echo "$ARTIFACTS" | jq -r '.[]|select(.type=="Docker Manifest")|select(.name|test("another-binary:v"))|.extra.Digest')" >> "$GITHUB_OUTPUT"
+        echo "name=$(echo "$ARTIFACTS" | jq -r '.[]|select(.type=="Docker Manifest")|select(.name|test("another-binary:v"))|.name|split(":")[0]')" >> "$GITHUB_OUTPUT"
+      id: image_metadata_another_binary
+      env:
+        ARTIFACTS: ${{steps.goreleaser.outputs.artifacts}}
+    # attest images
     - uses: actions/attest-build-provenance@49df96e17e918a15956db358890b08e61c704919 # v1.2.0
       with:
-        subject-path: "dist/*.tar.gz"
-    # attest images
+        subject-digest: ${{steps.image_metadata_go_cli_github.outputs.digest}}
+        subject-name: ${{steps.image_metadata_go_cli_github.outputs.name}}
+        push-to-registry: true
     - uses: actions/attest-build-provenance@49df96e17e918a15956db358890b08e61c704919 # v1.2.0
       with:
-        subject-digest: ${{steps.image_metadata.outputs.digest}}
-        subject-name: ${{steps.image_metadata.outputs.name}}
+        subject-digest: ${{steps.image_metadata_another_binary.outputs.digest}}
+        subject-name: ${{steps.image_metadata_another_binary.outputs.name}}
         push-to-registry: true

.goreleaser.yaml

@@ -1,6 +1,7 @@
 version: 2
 builds:
-- id: go-cli-github
+- &buildDefinition
+  id: go-cli-github
   binary: go-cli-github
   main: ./cmd/go-cli-github
   ldflags:
@@ -19,6 +20,10 @@ builds:
   goarch:
   - amd64
   - arm64
+- <<: *buildDefinition
+  id: another-binary
+  binary: another-binary
+  main: ./cmd/another-binary
 
 changelog:
   use: github-native
@@ -41,6 +46,23 @@ dockers:
   build_flag_templates:
   - "--build-arg=BINARY=go-cli-github"
   - "--platform=linux/arm64/v8"
+- ids:
+  - another-binary
+  image_templates:
+  - "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/another-binary:v{{ .Version }}-amd64"
+  use: buildx
+  build_flag_templates:
+  - "--build-arg=BINARY=another-binary"
+  - "--platform=linux/amd64"
+- ids:
+  - another-binary
+  image_templates:
+  - "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/another-binary:v{{ .Version }}-arm64v8"
+  use: buildx
+  goarch: arm64
+  build_flag_templates:
+  - "--build-arg=BINARY=another-binary"
+  - "--platform=linux/arm64/v8"
 
 docker_manifests:
 - name_template: "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/go-cli-github:v{{ .Version }}"
@@ -51,6 +73,14 @@ docker_manifests:
   image_templates:
   - "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/go-cli-github:v{{ .Version }}-amd64"
   - "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/go-cli-github:v{{ .Version }}-arm64v8"
+- name_template: "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/another-binary:v{{ .Version }}"
+  image_templates:
+  - "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/another-binary:v{{ .Version }}-amd64"
+  - "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/another-binary:v{{ .Version }}-arm64v8"
+- name_template: "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/another-binary:latest"
+  image_templates:
+  - "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/another-binary:v{{ .Version }}-amd64"
+  - "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/another-binary:v{{ .Version }}-arm64v8"
 
 release:
   extra_files:

cmd/another-binary/main.go

@@ -0,0 +1,8 @@
+// Package main implements the command-line interface of a server.
+package main
+
+import "fmt"
+
+func main() {
+	fmt.Println("Hello, World!")
+}