fix(ci): keep release artifacts separate until names are checked (#31)

Download each release artifact into its own directory and fail when two
files share a name, before the SBOM or the signatures are created.

.github/workflows/release.yml

@@ -115,6 +115,14 @@ on:
       AZURE_CERT_PROFILE:
         required: false
 
+    outputs:
+      version:
+        description: "Resolved release version without a leading v"
+        value: ${{ jobs.version.outputs.version }}
+      prerelease:
+        description: "Whether the resolved version is a prerelease"
+        value: ${{ jobs.version.outputs.prerelease }}
+
 permissions:
   contents: read
 
@@ -260,6 +268,9 @@ jobs:
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
         run: packaging/macos/verify.sh --arch universal
+      - name: Note missing macOS verification
+        if: github.ref == 'refs/heads/release' && hashFiles('packaging/macos/verify.sh') == ''
+        run: echo "::warning::packaging/macos/verify.sh is missing, so this release was not checked for a signature or notarization ticket."
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-macos

.github/workflows/supply-chain.yml

@@ -0,0 +1,78 @@
+name: "Supply chain"
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: "Resolved release version without a leading v (needs.release.outputs.version)"
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  attest:
+    name: SBOM and signatures
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+    steps:
+      - name: Download release artifacts
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          pattern: release-*
+          path: artifacts
+          merge-multiple: false
+
+      - name: Collect release files
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p subjects
+          find artifacts -type f -print0 > "$PWD/release-files"
+          if [ ! -s "$PWD/release-files" ]; then
+            echo "::error::no release files were downloaded"
+            exit 1
+          fi
+          while IFS= read -r -d '' file; do
+            base="$(basename "$file")"
+            if [ -e "subjects/$base" ]; then
+              echo "::error::duplicate release file name: $base"
+              exit 1
+            fi
+            cp "$file" "subjects/$base"
+          done < "$PWD/release-files"
+
+      - name: Generate the CycloneDX SBOM
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+        with:
+          path: subjects
+          format: cyclonedx-json
+          output-file: sbom.cyclonedx.json
+          upload-artifact: "false"
+          upload-release-assets: "false"
+          dependency-snapshot: "false"
+
+      - name: Sign the release files
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: subjects/*
+
+      - name: Attest the SBOM
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: subjects/*
+          sbom-path: sbom.cyclonedx.json
+
+      - name: Attach the SBOM to the draft release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.version }}
+        run: |
+          tag="v${VERSION#v}"
+          gh release upload "$tag" sbom.cyclonedx.json --clobber