build-binary-signed-ghat-malicious.yml

name: binary-signed-ghat-malicious

on:
  workflow_dispatch:

jobs:
  build:
    permissions:
      id-token: write
      packages: write
      contents: write
      attestations: write

    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v4

      - name: The malicious step
        run: |
          echo "// This is a malicious update" >> main.go

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.21'

      - name: Run Go build
        run: |
          go build -v -o demo-repo-go-binary ./...

      - name: Sign artifact
        uses: actions/attest-build-provenance@v1.4.1
        with:
          subject-path: '${{ github.workspace }}/demo-repo-go-binary'

      - name: Upload artifact
        uses: actions/upload-artifact@v3
        with:
          name: demo-repo-go-binary
          path: demo-repo-go-binary