Merge pull request #10706 from derrod/ci-attestation

CI: Generate/Verify Attestation for Windows builds

.github/actions/windows-patches/action.yaml

@@ -33,8 +33,9 @@ runs:
       run: |
         # Download OBS release
         . ${env:GITHUB_ACTION_PATH}\Invoke-External.ps1
-        Invoke-External gh release download "${{ inputs.tagName }}" -p "*-Windows.zip"
-        Expand-Archive -Path "*-Windows.zip" -DestinationPath "${{ github.workspace }}/build"
+        Invoke-External gh release download "${{ inputs.tagName }}" -p "OBS-Studio-${{ inputs.tagName }}-Windows.zip"
+        Invoke-External gh attestation verify "OBS-Studio-${{ inputs.tagName }}-Windows.zip" --owner obsproject
+        Expand-Archive -Path "OBS-Studio-${{ inputs.tagName }}-Windows.zip" -DestinationPath "${{ github.workspace }}/build"
 
     - name: Setup bouf
       shell: pwsh

.github/workflows/push.yaml

@@ -207,12 +207,13 @@ jobs:
 
   sign-windows-build:
     name: Windows Signing ✍️
-    uses: obsproject/obs-studio/.github/workflows/sign-windows.yaml@d7bf65a80b40bec6446dcb4a2f03629fb74cc3f9
+    uses: obsproject/obs-studio/.github/workflows/sign-windows.yaml@b5b457d7b059397b70f6e3dd09b65e172ad734c3
     if: github.repository_owner == 'obsproject' && github.ref_type == 'tag'
     needs: build-project
     permissions:
       contents: 'read'
       id-token: 'write'
+      attestations: 'write'
     secrets: inherit
 
   create-release:

.github/workflows/sign-windows.yaml

@@ -52,6 +52,11 @@ jobs:
           version: ${{ github.ref_name }}
           channel: ${{ steps.setup.outputs.channel }}
 
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: ${{ github.workspace }}/output/*-x64.zip
+
       - name: Upload Signed Build
         uses: actions/upload-artifact@v4
         with: