SLSA provenance attestation

[johnbillion]

See johnbillion/action-wordpress-plugin-attestation#12

[szepeviktor]

You want two things in one workflow ...

[johnbillion]

Yeah it's not always easy to determine whether an action is a composite

[szepeviktor]

It is a reusable one. It cannot live as a step.

reusable workflows should be referenced at the top-level `jobs.*.uses' key, not within steps

[szepeviktor]

I think this level3 thing must be in your build process.
https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-and-reusable-workflows-to-achieve-slsa-v1-build-level-3

[johnbillion]

I think I rabbit-holed on the actions provided by the SLSA framework due to the isolation requirement for level 3. The annoying thing about using a reusable workflow for a GitHub build provenance attestation is that you then need to verify it using the name of the repo that contains the reusable workflow that created the attestation.

It looks like I need to read into this more.