# SLSA Provenance Generation for Python Libs
# Generates SLSA Level 3 provenance attestations for published packages.
#
# This workflow builds the package, generates hashes, and calls the org-level
# SLSA provenance workflow to create cryptographic attestations.
#
# Reference: https://slsa.dev/
name: SLSA Provenance

on:
  # Trigger after successful release
  workflow_run:
    workflows: ["Semantic Release"]
    types: [completed]
    branches: [main, master]
  # Manual trigger for re-generating provenance
  workflow_dispatch:
    inputs:
      version:
        description: 'Version to generate provenance for (e.g., 0.1.0)'
        required: true
        type: string

permissions:
  contents: read

jobs:
  # ==========================================================================
  # Build and Generate Hashes
  # ==========================================================================
  build:
    name: Build Package
    runs-on: ubuntu-latest
    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
    permissions:
      contents: read
      id-token: write
      actions: read
      attestations: write
    outputs:
      hashes: ${{ steps.hashes.outputs.hashes }}
      version: ${{ steps.version.outputs.version }}

    steps:
      - name: Harden the runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      - name: Install UV
        uses: astral-sh/setup-uv@18d369b23da25a81e9458561248e1aafff6a70fa # v10.3.1
        with:
          enable-cache: true

      - name: Determine version
        id: version
        run: |
          if [ -n "${{ github.event.inputs.version }}" ]; then
            VERSION="${{ github.event.inputs.version }}"
          else
            VERSION=$(grep -Po '(?<=^version = ")[^"]*' pyproject.toml)
          fi
          echo "version=$VERSION" >> $GITHUB_OUTPUT

      - name: Build package
        run: uv build

      - name: Generate SHA256 hashes
        id: hashes
        run: |
          cd dist
          HASHES=$(sha256sum * | base64 -w0)
          echo "hashes=$HASHES" >> $GITHUB_OUTPUT

      - name: Upload build artifacts
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist-${{ steps.version.outputs.version }}
          path: dist/
          retention-days: 90

      - name: Generate artifact attestation
        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
        with:
          subject-path: 'dist/*'

  # ==========================================================================
  # SLSA Level 3 Provenance (Org-Level Reusable Workflow)
  # ==========================================================================
  slsa:
    name: SLSA Level 3
    needs: [build]
    uses: ByronWilliamsCPA/.github/.github/workflows/python-slsa.yml@987d517d3c8e4b180f4dd15de6d9575f0df91182 # main
    with:
      base64-subjects: ${{ needs.build.outputs.hashes }}
      upload-assets: true
    permissions:
      id-token: write
      contents: write
      actions: read