Upload attestations to GitHub (#76)

* Add the distributionManagement back to the pom

* Upload attestations to GitHub

.github/workflows/release.yml

@@ -15,6 +15,7 @@ jobs:
       contents: read
       packages: write
       id-token: write
+      attestations: write
 
     env:
       GRADLE_OPTS: -Dorg.gradle.caching=true
@@ -29,7 +30,7 @@ jobs:
           java-version: 21
       - uses: gradle/actions/setup-gradle@v4
       - name: Release maven artifacts
-        run: ./gradlew -Pversion=$version publish
+        run: ./gradlew -Pversion=$version publish uploadSignaturesToGitHub
         env:
           ORG_GRADLE_PROJECT_GitHubPackagesUsername: ${{ github.actor }}
           ORG_GRADLE_PROJECT_GitHubPackagesPassword: ${{ github.token }}

gradle/build-logic/build.gradle.kts

@@ -5,6 +5,7 @@ plugins {
 dependencies {
     implementation(libs.plugins.kotlin.jvm.dep)
     implementation(libs.plugins.sigstore.dep)
+    implementation(libs.ktor.client.cio)
 }
 
 val Provider<PluginDependency>.dep: Provider<String> get() = map { "${it.pluginId}:${it.pluginId}.gradle.plugin:${it.version}" }

gradle/build-logic/src/main/kotlin/UploadSignatures.kt

@@ -0,0 +1,53 @@
+import io.ktor.client.*
+import io.ktor.client.engine.cio.*
+import io.ktor.client.plugins.*
+import io.ktor.client.request.*
+import io.ktor.http.*
+import kotlinx.coroutines.runBlocking
+import org.gradle.api.DefaultTask
+import org.gradle.api.credentials.PasswordCredentials
+import org.gradle.api.file.ConfigurableFileCollection
+import org.gradle.api.provider.Property
+import org.gradle.api.tasks.*
+import org.gradle.kotlin.dsl.credentials
+import org.gradle.work.DisableCachingByDefault
+
+@DisableCachingByDefault(because = "Remote operation")
+abstract class UploadSignatures : DefaultTask() {
+    @get:InputFiles
+    @get:PathSensitive(PathSensitivity.NONE)
+    abstract val signatures: ConfigurableFileCollection
+
+    @get:Input
+    abstract val githubApiUrl: Property<String>
+
+    @get:Input
+    val githubCredentials = project.providers.credentials(PasswordCredentials::class, "GitHubPackages")
+
+    @get:Input
+    abstract val githubRepository: Property<String>
+
+
+    @TaskAction
+    internal fun uploadSignatures(): Unit = runBlocking {
+        HttpClient(CIO) {
+            defaultRequest {
+                url.takeFrom(githubApiUrl.get())
+                accept(ContentType.parse("application/vnd.github+json"))
+                bearerAuth(githubCredentials.get().password!!)
+            }
+        }.use { client ->
+            for (file in signatures) {
+                client.post(
+                    "/repos/${githubRepository.get()}/attestations"
+                ) {
+                    //language=json
+                    val bundle = """
+                        { "bundle": ${file.readText()} }
+                    """.trimIndent()
+                    setBody(bundle)
+                }
+            }
+        }
+    }
+}

gradle/build-logic/src/main/kotlin/setup.gradle.kts

@@ -54,3 +54,9 @@ tasks.withType(SigstoreSignFilesTask::class).configureEach {
         languageVersion.set(JavaLanguageVersion.of(21))
     })
 }
+
+tasks.register("uploadSignaturesToGitHub", UploadSignatures::class) {
+    signatures.from(tasks.withType(SigstoreSignFilesTask::class))
+    githubApiUrl = providers.environmentVariable("GITHUB_API_URL")
+    githubRepository = providers.environmentVariable("GITHUB_REPOSITORY")
+}

gradle/libs.versions.toml

@@ -1,6 +1,9 @@
 [versions]
 kotlin = "2.1.0-Beta1"
 
+[libraries]
+ktor-client-cio = { module = "io.ktor:ktor-client-cio", version = "2.3.8" }
+
 [plugins]
 kotlin-jvm = { id = "org.jetbrains.kotlin.jvm", version.ref = "kotlin" }
 sigstore = { id = "dev.sigstore.sign", version = "1.0.0" }