From 3b8e2453a4339a6fbe1694f8fcb5bbd3c217cd36 Mon Sep 17 00:00:00 2001
From: Alasdair <alasdair.armstrong@cl.cam.ac.uk>
Date: Thu, 29 Aug 2024 14:32:34 +0100
Subject: [PATCH] Try github attestations

---
 .github/workflows/release.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8bc8bbc35..94649e60d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,6 +2,10 @@ name: Release tarball
 
 on: [workflow_dispatch]
 
+permissions:
+  id-token: write
+  attestations: write
+
 env:
   OPAMVERBOSE: 1
 
@@ -109,6 +113,10 @@ jobs:
         eval $(opam env)
         make tarball TARBALL_EXTRA_BIN=$(which z3)
 
+    - uses: actions/attest-build-provenance@v1
+      with:
+        subject-path: _build/sail.tar.gz
+
     - name: Upload tarball
       uses: actions/upload-artifact@v4
       with: