local_attest.yml

name: Attest to this repo's source
on:
  push:
    branches: [ "main" ]
  # TODO: Remove workflow_dispatch so that we only create VSAs for protected branches
  # contemporaneously to the change.  (And probably really check in
  # create_slsa_source_vsa.yml).
  workflow_dispatch:

jobs:
  # Whenever new source is pushed or a PR is received, scan it for any issues
  check-change:
    permissions:
      contents: read
      id-token: write
    # TODO: Can we make this work for forks too?
    uses: slsa-framework/slsa-source-poc/.github/workflows/create_slsa_source_vsa.yml@main