attest w/ new build type

Signed-off-by: Brian DeHamer <bdehamer@github.com>

.github/workflows/new-build-type.yml

@@ -0,0 +1,59 @@
+name: Attest w/ New GHA Build Type
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: self-attest
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      attestations: write
+    steps:
+      - name: OIDC Token
+        run: |
+          curl "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=donottrust" \
+            -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \
+            -H "Accept: application/json; api-version=2.0" \
+            -H "Content-Type: application/json" \
+            --silent | jq -r '.value' > oidc_token
+          cat oidc_token | jq -R 'split(".") | .[1] | @base64d | fromjson' > claims.json
+          cat claims.json
+          echo "GITHUB_JOB_WORKFLOW_REF=$(cat claims.json | jq -r '.job_workflow_ref')" >> "$GITHUB_ENV"
+      - name: Create Subject
+        run: |
+          date > subject.txt
+      - name: Assemble Provenance
+        run: |
+          jq --null-input \
+            --arg ref "${{ github.ref }}" \
+            --arg repository "${{ github.server_url }}/${{ github.repository }}" \
+            --arg workflow_path ".github/workflows/new-build-type.yml" \
+            --arg event_name "${{ github.event_name }}" \
+            --arg repository_id "${{ github.repository_id }}" \
+            --arg repository_owner_id "${{ github.repository_owner_id }}" \
+            --arg runner_environment "${RUNNER_ENVIRONMENT}" \
+            --arg repository_uri "git+${{ github.server_url }}/${{ github.repository }}@${{ github.ref }}" \
+            --arg sha "${{ github.sha }}" \
+            --arg builder_id "${{ github.server_url }}/${GITHUB_JOB_WORKFLOW_REF}" \
+            --arg invocation_id "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}" \
+            '{"buildDefinition":{"buildType":"https://actions.github.io/buildtypes/workflow/v1","externalParameters":{"workflow":{"ref":$ref,"repository":$repository,"path":$workflow_path}},"internalParameters":{"github":{"event_name":$event_name,"repository_id":$repository_id,"repository_owner_id":$repository_owner_id,"runner_environment":$runner_environment}},"resolvedDependencies":[{"uri":$repository_uri,"digest":{"gitCommit":$sha}}]},"runDetails":{"builder":{"id":$builder_id},"metadata":{"invocationId":$invocation_id}}}' > predicate.json
+      - name: Attest
+        id: attest
+        env:
+          INPUT_SKIP-ATTESTATION-STORE: "true"
+        uses: actions/attest@bdehamer/skip-attestation-store
+        with:
+          subject-path: subject.txt
+          predicate-type: https://slsa.dev/provenance/v1
+          predicate-path: predicate.json
+      - name: Dump Attestation
+        run: |
+          cat ${{ steps.attest.outputs.bundle-path }} | jq
+      - name: Attest (Official)
+        uses: actions/attest@v1
+        with:
+          subject-path: subject.txt
+          predicate-type: https://slsa.dev/provenance/v1
+          predicate-path: predicate.json