Attest を追加 (#136)

Co-authored-by: Syuugo <pub@s1204.me>

.github/workflows/build.yml

@@ -23,6 +23,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
+      attestations: write
     steps:
 
       - name: Checkout
@@ -47,14 +49,14 @@ jobs:
 
       - name: Get previous version name
         uses: oprypin/find-latest-tag@v1.1.2
-        if: github.event.inputs.release == 'true'
+        if: github.event.inputs.release
         id: previous
         with:
           repository: ${{ github.repository }}
           releases-only: true
 
       - name: Release check
-        if: github.event.inputs.release == 'true'
+        if: github.event.inputs.release
         run: |
           if [ "${{ secrets.STORE_FILE }}" == "" ]; then
             echo -e "\nERROR!\nTo release, you need to set up a signing key! \n"
@@ -85,6 +87,12 @@ jobs:
             ./gradlew assembleDebug --no-daemon --stacktrace
           fi
 
+      - name: Attest
+        uses: actions/attest-build-provenance@v1
+        if: github.event.inputs.release != 'true'
+        with:
+          subject-path: app/build/outputs/apk/debug/app-debug.apk
+
       - name: Upload APK
         uses: actions/upload-artifact@v4
         if: github.event.inputs.release != 'true'
@@ -94,7 +102,7 @@ jobs:
 
       - name: Release
         uses: softprops/action-gh-release@v2
-        if: github.event.inputs.release == 'true'
+        if: github.event.inputs.release
         with:
           tag_name: ${{ env.version }}
           draft: false