Create generator-generic-ossf-slsa3-publish.yml by Kushmanmb · Pull Request #1640 · github/gh-ost

This pull request adds a new GitHub Actions workflow to generate SLSA provenance files for project artifacts, enhancing supply chain security and compliance with SLSA level 3 requirements. The workflow builds artifacts, computes their hashes, and uses the OpenSSF SLSA generator to produce and optionally upload provenance files during releases or manual dispatches.

Supply Chain Security Integration:

  • Added a new workflow file .github/workflows/generator-generic-ossf-slsa3-publish.yml that builds sample artifacts, computes their SHA256 hashes, and generates SLSA provenance files using the slsa-framework/slsa-github-generator action.
  • Configured the workflow to trigger on releases and manual dispatch, and to upload provenance files as release assets for verification and traceability.## A Pull Request should be associated with an Issue.

We wish to have discussions in Issues. A single issue may be targeted by multiple PRs.
If you're offering a new feature or fixing anything, we'd like to know beforehand in Issues,
and potentially we'll be able to point development in a particular direction.

Related issue: https://github.com/github/gh-ost/issues/0123456789

Further notes in https://github.com/github/gh-ost/blob/master/.github/CONTRIBUTING.md
Thank you! We are open to PRs, but please understand if for technical reasons we are unable to accept each and any PR

Description

This PR [briefly explain what it does]

In case this PR introduced Go code changes:

  • contributed code is using same conventions as original code
  • script/cibuild returns with no formatting errors, build errors or unit test errors.