Attest compiled binaries

Author: simolus3

.github/workflows/compile_sqlite.yml

@@ -2,6 +2,11 @@ name: Download and compile SQLite
 
 on:
   workflow_call:
+    inputs:
+      attest:
+        description: "Whether to generate a signed attestation for compiled artifacts"
+        type: boolean
+        default: false
     outputs:
       artifact_id:
         description: "ID of the artifact containing prebuilt SQLite libraries"
@@ -411,6 +416,10 @@ jobs:
       - compile_pool_linux_android
       - compile_pool_apple
       - compile_pool_windows
+    permissions:
+      attestations: write
+      id-token: write
+      artifact-metadata: write
     name: Merge prebuilt libraries into single directory
     outputs:
       sqlite_merged: ${{ steps.upload.outputs.artifact-id }}
@@ -436,6 +445,14 @@ jobs:
       - run: ls -al out/
       - run: ls -al sqlite3_connection_pool/lib/src/precompiled/
 
+      - name: Attest
+        if: inputs.attest
+        uses: actions/attest@v4
+        with:
+          subject-path: |
+            out/*
+            sqlite3_connection_pool/lib/src/precompiled/*
+
       - name: Upload sqlite3 binaries
         uses: actions/upload-artifact@v7
         id: upload

.github/workflows/main.yml

@@ -14,6 +14,8 @@ jobs:
   fetch_sqlite:
     if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
     uses: ./.github/workflows/compile_sqlite.yml
+    with:
+      attest: true #todo revert
 
   zizmor:
     runs-on: ubuntu-latest