init attest build provenance

action.yml

@@ -1,24 +1,59 @@
-name: 'The name of your action here'
-description: 'Provide a description here'
-author: 'Your name or organization here'
+name: 'Attest Build Provenance'
+description: 'Generate provenance attestations for build artifacts'
+author: 'GitHub'
 
-# Add your action's branding here. This will appear on the GitHub Marketplace.
-branding:
-  icon: 'heart'
-  color: 'red'
-
-# Define your inputs here.
 inputs:
-  milliseconds:
-    description: 'Your input description here'
-    required: true
-    default: '1000'
-
-# Define your outputs here.
+  github-token:
+    description: >
+      The GitHub token used to make authenticated API requests.
+    default: ${{ github.token }}
+    required: false
+  subject-path:
+    description: >
+      Path to the artifact for which provenance will be generated. Must specify
+      exactly one of "subject-path" or "subject-digest".
+    required: false
+  subject-digest:
+    description: >
+      Digest of the subject for which provenance will be generated. Must be in
+      the form "algorithm:hex_digest" (e.g. "sha256:abc123..."). Must specify
+      exactly one of "subject-path" or "subject-digest".
+    required: false
+  subject-name:
+    description: >
+      Subject name as it should appear in the provenance statement. Required
+      unless "subject-path" is specified, in which case it will be inferred from
+      the path.
+  push-to-registry:
+    description: >
+      Whether to push the provenance statement to the image registry. Requires
+      that the "subject-name" parameter specify the fully-qualified image name
+      and that the "subject-digest" parameter be specified. Defaults to false.
+    default: false
+    required: false
 outputs:
-  time:
-    description: 'Your output description here'
+  bundle-path:
+    description: 'The path to the file containing the attestation bundle(s).'
+    value: ${{ steps.attest.outputs.bundle-path }}
 
 runs:
-  using: node20
-  main: dist/index.js
+  using: 'composite'
+  steps:
+    - uses: ./generate-build-provenance-statement
+      id: generate-build-provenance-statement
+      with:
+        github-token: ${{ inputs.github-token }}
+        subject-path: ${{ inputs.subject-path }}
+        subject-digest: ${{ inputs.subject-digest }}
+        subject-name: ${{ inputs.subject-name }}
+        push-to-registry: ${{ inputs.push-to-registry }}
+    - uses: actions/attest
+      id: attest
+      with:
+        github-token: ${{ inputs.github-token }}
+        subject-path: ${{ inputs.subject-path }}
+        subject-digest: ${{ inputs.subject-digest }}
+        subject-name: ${{ inputs.subject-name }}
+        push-to-registry: ${{ inputs.push-to-registry }}
+        predicate-type: ${{ steps.generate-build-provenance-statement.outputs.predicate-type }}
+        predicate: ${{ steps.generate-build-provenance-statement.outputs.predicate }}