Build Package #3

	name: Build Package

	on:
	workflow_dispatch:

	jobs:
	build:
	name: build package
	runs-on: ubuntu-latest
	permissions:
	attestations: write
	contents: read
	id-token: write

	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
	with:
	node-version: 18
	cache: npm

	- name: Install dependencies
	run: npm install

	- name: Build package
	run: npm run build

	- name: Compare Expected and Actual Directories
	id: diff
	run: \|
	if [ "$(git diff --ignore-space-at-eol --text dist/ \| wc -l)" -gt "0" ]; then
	echo "Detected uncommitted changes after build. See status below:"
	git diff --ignore-space-at-eol --text dist/
	exit 1
	fi

	# If index.js was different than expected, upload the expected version as
	# a workflow artifact.
	- uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
	if: ${{ failure() && steps.diff.conclusion == 'failure' }}
	with:
	name: dist
	path: dist/

	- name: Attest build provenance
	uses: actions/attest-build-provenance@v1
	with:
	subject-path: "dist/*"

	- name: Generate SBOM
	uses: anchore/[email protected]
	with:
	format: "spdx-json"
	output-file: "sbom.spdx.json"

	- name: Attest SBOM
	uses: actions/attest-sbom@v1
	with:
	subject-path: "dist/*"
	sbom-path: "sbom.spdx.json"

Provide feedback