name: CI
permissions: read-all

on:
  # For manual tests.
  workflow_dispatch:
  push:
    tags:
      - "*" # new tag version, like `0.8.4` or else
    branches:
      - master
  pull_request:
    branches:
      - master
  schedule:
    # Run daily at 4:45 A.M. to catch dependencies that break us.
    - cron: '45 4 * * *'

jobs:
  build-linux:
    permissions:
      contents: write
    outputs:
      digests-gcc: ${{ steps.hash-gcc.outputs.hashes }}
      digests-clang: ${{ steps.hash-clang.outputs.hashes }}
    name: Build Linux
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        cxx: [g++-13, clang++-18]
      fail-fast: false
    steps:
    - uses: actions/checkout@v6
    - name: cmake
      run: CXX=${{ matrix.cxx }} cmake -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_STRICT_MODE=ON -DFLATBUFFERS_STATIC_FLATC=ON .
    - name: build
      run: make -j
    - name: test
      run: ./flattests
    - name: make flatc executable
      run: |
        chmod +x flatc
        ./flatc --version
    - name: upload build artifacts
      uses: actions/upload-artifact@v7
      with:
        name: Linux flatc binary ${{ matrix.cxx }}
        path: flatc
    # Below if only for release.
    - name: Zip file
      if: startsWith(github.ref, 'refs/tags/')
      run: zip Linux.flatc.binary.${{ matrix.cxx }}.zip flatc
    - name: Release zip file
      uses: softprops/action-gh-release@v2
      if: startsWith(github.ref, 'refs/tags/')
      with:
        files: Linux.flatc.binary.${{ matrix.cxx }}.zip
    - name: Generate SLSA subjects - clang
      if: matrix.cxx == 'clang++-18' && startsWith(github.ref, 'refs/tags/')
      id: hash-clang
      run: echo "hashes=$(sha256sum Linux.flatc.binary.${{ matrix.cxx }}.zip | base64 -w0)" >> $GITHUB_OUTPUT
    - name: Generate SLSA subjects - gcc
      if: matrix.cxx == 'g++-13' && startsWith(github.ref, 'refs/tags/')
      id: hash-gcc
      run: echo "hashes=$(sha256sum Linux.flatc.binary.${{ matrix.cxx }}.zip | base64 -w0)" >> $GITHUB_OUTPUT

  build-linux-no-file-tests:
    name: Build Linux with -DFLATBUFFERS_NO_FILE_TESTS
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v6
    - name: cmake
      run: CXX=clang++-18 cmake -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_STRICT_MODE=ON -DFLATBUFFERS_CXX_FLAGS="-DFLATBUFFERS_NO_FILE_TESTS" .
    - name: build
      run: make -j
    - name: test
      run: ./flattests

  build-linux-out-of-source:
    name: Build Linux with out-of-source build location
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v6
    - name: make build directory
      run: mkdir build
    - name: cmake
      working-directory: build
      run: >
        CXX=clang++-18 cmake .. -G "Unix Makefiles" -DFLATBUFFERS_STRICT_MODE=ON
        -DFLATBUFFERS_BUILD_CPP17=ON -DFLATBUFFERS_CPP_STD=17
    - name: build
      working-directory: build
      run: make -j
    - name: test
      working-directory: build
      run: pwd && ./flattests
    - name: test C++17
      working-directory: build
      run: ./flattests_cpp17

  build-linux-cpp-std:
    name: Build Linux C++
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false
      matrix:
        std: [11, 14, 17, 20, 23]
        cxx: [g++-13, clang++-18]
        exclude:
          # Clang++15 10.3.0 stdlibc++ doesn't fully support std 23
          - cxx: clang++-18
            std: 23

    steps:
    - uses: actions/checkout@v6
    - name: cmake
      run: >
        CXX=${{ matrix.cxx }} cmake -G "Unix Makefiles"
        -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_STRICT_MODE=ON
        -DFLATBUFFERS_CPP_STD=${{ matrix.std }}
        -DFLATBUFFERS_BUILD_CPP17=${{ matrix.std >= 17 && 'On' || 'Off'}}
    - name: build
      run: make -j
    - name: test
      run: ./flattests
    - name: test C++17
      if: matrix.std >= 17
      run: ./flattests_cpp17

  build-cpp-std:
    name: Build Windows C++
    runs-on: windows-2022
    strategy:
      matrix:
        std: [11, 14, 17, 20, 23]
      fail-fast: false
    steps:
    - uses: actions/checkout@v6
    - name: Add msbuild to PATH
      uses: microsoft/setup-msbuild@v2
    - name: cmake
      run: >
        cmake -G "Visual Studio 17 2022" -A x64 -DCMAKE_BUILD_TYPE=Release
        -DFLATBUFFERS_STRICT_MODE=ON
        -DFLATBUFFERS_CPP_STD=${{ matrix.std }}
        -DFLATBUFFERS_BUILD_CPP17=${{ matrix.std >= 17 && 'On' || 'Off'}}
    - name: build
      run: msbuild.exe FlatBuffers.sln /p:Configuration=Release /p:Platform=x64
    - name: test
      run: Release\flattests.exe
    - name: test C++17
      if: matrix.std >= 17
      run: Release\flattests_cpp17.exe

  build-windows:
    permissions:
      contents: write
    outputs:
      digests: ${{ steps.hash.outputs.hashes }}
    name: Build Windows 2022
    runs-on: windows-2022
    steps:
    - uses: actions/checkout@v6
    - name: Add msbuild to PATH
      uses: microsoft/setup-msbuild@v2
    - name: cmake
      run: cmake -G "Visual Studio 17 2022" -A x64 -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_BUILD_CPP17=ON -DFLATBUFFERS_STRICT_MODE=ON .
    - name: build
      run: msbuild.exe FlatBuffers.sln /p:Configuration=Release /p:Platform=x64
    - name: test
      run: Release\flattests.exe
    - name: upload build artifacts
      uses: actions/upload-artifact@v7
      with:
        name: Windows flatc binary
        path: Release\flatc.exe
    # Below if only for release.
    - name: Zip file
      if: startsWith(github.ref, 'refs/tags/')
      run: move Release/flatc.exe . && Compress-Archive flatc.exe Windows.flatc.binary.zip
    - name: Release binary
      uses: softprops/action-gh-release@v2
      if: startsWith(github.ref, 'refs/tags/')
      with:
        files: Windows.flatc.binary.zip
    - name: Generate SLSA subjects
      if: startsWith(github.ref, 'refs/tags/')
      id: hash
      shell: bash
      run: echo "hashes=$(sha256sum Windows.flatc.binary.zip | base64 -w0)" >> $GITHUB_OUTPUT

  build-dotnet-windows:
    name: Build .NET Windows
    runs-on: windows-2022
    strategy:
      matrix:
        configuration: [
          '',
          '-p:UnsafeByteBuffer=true',
          '-p:EnableSpanT=true,UnsafeByteBuffer=true'
          ]
    steps:
    - uses: actions/checkout@v6
    - name: Setup .NET Core SDK
      uses: actions/setup-dotnet@v5
      with:
        dotnet-version: '8.0.x'
    - name: Build
      run: |
        cd tests\FlatBuffers.Test
        dotnet new sln --force --name FlatBuffers.Test --format sln
        dotnet sln FlatBuffers.Test.sln add FlatBuffers.Test.csproj
        dotnet build -c Release ${{matrix.configuration}} FlatBuffers.Test.sln
    - name: Run net6.0
      run: |
        cd tests\FlatBuffers.Test\bin\Release\net6.0
        dir
        .\FlatBuffers.Test.exe
    - name: Run net8.0
      run: |
        cd tests\FlatBuffers.Test\bin\Release\net8.0
        .\FlatBuffers.Test.exe

  build-mac-intel:
    permissions:
      contents: write
    outputs:
      digests: ${{ steps.hash.outputs.hashes }}
    name: Build Mac (for Intel)
    runs-on: macos-15-intel
    steps:
    - uses: actions/checkout@v6
    - name: cmake
      run: cmake -G "Xcode" -DCMAKE_OSX_ARCHITECTURES="x86_64" -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_STRICT_MODE=ON .
    - name: build
      run: xcodebuild -toolchain clang -configuration Release -target flattests
    - name: check that the binary is x86_64
      run: |
        info=$(file Release/flatc)
        echo $info
        echo $info | grep "Mach-O 64-bit executable x86_64"
    - name: test
      run: Release/flattests
    - name: make flatc executable
      run: |
        chmod +x Release/flatc
        Release/flatc --version
    - name: upload build artifacts
      uses: actions/upload-artifact@v7
      with:
        name: Mac flatc binary Intel
        path: Release/flatc
    # Below if only for release.
    - name: Zip file
      if: startsWith(github.ref, 'refs/tags/')
      run: mv Release/flatc . && zip MacIntel.flatc.binary.zip flatc
    - name: Release binary
      uses: softprops/action-gh-release@v2
      if: startsWith(github.ref, 'refs/tags/')
      with:
        files: MacIntel.flatc.binary.zip
    - name: Generate SLSA subjects
      if: startsWith(github.ref, 'refs/tags/')
      id: hash
      run: echo "hashes=$(shasum -a 256 MacIntel.flatc.binary.zip | base64)" >> $GITHUB_OUTPUT

  build-mac-universal:
    permissions:
      contents: write
    outputs:
      digests: ${{ steps.hash.outputs.hashes }}
    name: Build Mac (universal build)
    runs-on: macos-latest
    steps:
    - uses: actions/checkout@v6
    - name: cmake
      run: cmake -G "Xcode" -DCMAKE_OSX_ARCHITECTURES="arm64;x86_64" -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_STRICT_MODE=ON .
    - name: build
      run: xcodebuild -toolchain clang -configuration Release -target flattests
    - name: check that the binary is "universal"
      run: |
        info=$(file Release/flatc)
        echo $info
        echo $info | grep "Mach-O universal binary with 2 architectures"
    - name: test
      run: Release/flattests
    - name: make flatc executable
      run: |
        chmod +x Release/flatc
        Release/flatc --version
    - name: upload build artifacts
      uses: actions/upload-artifact@v7
      with:
        name: Mac flatc binary Universal
        path: Release/flatc
    # Below if only for release.
    - name: Zip file
      if: startsWith(github.ref, 'refs/tags/')
      run: mv Release/flatc . && zip Mac.flatc.binary.zip flatc
    - name: Release binary
      uses: softprops/action-gh-release@v2
      if: startsWith(github.ref, 'refs/tags/')
      with:
        files: Mac.flatc.binary.zip
    - name: Generate SLSA subjects
      if: startsWith(github.ref, 'refs/tags/')
      id: hash
      run: echo "hashes=$(shasum -a 256 Mac.flatc.binary.zip | base64)" >> $GITHUB_OUTPUT

  build-android:
   name: Build Android (on Linux)
   if: false #disabled due to continual failure
   runs-on: ubuntu-24.04
   steps:
   - uses: actions/checkout@v6
   - name: set up Java
     uses: actions/setup-java@v5
     with:
       distribution: temurin
       java-version: 17
   - name: set up Gradle
     uses: gradle/actions/setup-gradle@v5
   - name: set up flatc
     run: |
       cmake -DFLATBUFFERS_BUILD_TESTS=OFF -DFLATBUFFERS_BUILD_FLATLIB=OFF -DFLATBUFFERS_BUILD_FLATHASH=OFF -DFLATBUFFERS_STRICT_MODE=ON .
       make -j
       echo "${PWD}" >> $GITHUB_PATH
   - name: build
     working-directory: android
     run: gradle clean build

  build-generator:
    name: Check Generated Code
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        cxx: [g++-13, clang++-18]
    steps:
    - uses: actions/checkout@v6
    - name: cmake
      run: CXX=${{ matrix.cxx }} cmake -G "Unix Makefiles" -DFLATBUFFERS_BUILD_TESTS=OFF -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_STRICT_MODE=ON . && make -j
    - name: Generate
      run: scripts/check_generate_code.py
    - name: Generate gRPC
      run: scripts/check-grpc-generated-code.py

  build-generator-windows:
    name: Check Generated Code on Windows
    runs-on: windows-2022
    steps:
    - uses: actions/checkout@v6
    - name: Add msbuild to PATH
      uses: microsoft/setup-msbuild@v2
    - name: cmake
      run: cmake -G "Visual Studio 17 2022" -A x64 -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_BUILD_CPP17=ON -DFLATBUFFERS_STRICT_MODE=ON .
    - name: build
      run: msbuild.exe FlatBuffers.sln /p:Configuration=Release /p:Platform=x64
    - name: Generate
      run: python3 scripts/check_generate_code.py --flatc Release\flatc.exe
    - name: Generate gRPC
      run: python3 scripts/check-grpc-generated-code.py --flatc Release\flatc.exe

  build-benchmarks:
    name: Build Benchmarks (on Linux)
    runs-on: ubuntu-24.04
    strategy:
      matrix:
        cxx: [g++-13]
    steps:
    - uses: actions/checkout@v6
    - name: cmake
      run: CXX=${{ matrix.cxx }} cmake -G "Unix Makefiles" -DFLATBUFFERS_CXX_FLAGS="-Wno-unused-parameter -fno-aligned-new" -DFLATBUFFERS_BUILD_BENCHMARKS=ON -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_STRICT_MODE=ON . && make -j
    - name: Run benchmarks
      run: ./flatbenchmark --benchmark_repetitions=5 --benchmark_display_aggregates_only=true --benchmark_out_format=console --benchmark_out=benchmarks/results_${{matrix.cxx}}
    - name: Upload benchmarks results
      uses: actions/upload-artifact@v7
      with:
        name: Linux flatbenchmark results ${{matrix.cxx}}
        path: benchmarks/results_${{matrix.cxx}}

  build-java:
    name: Build Java
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v6
    - name: test
      working-directory: java
      run: mvn test

  build-kotlin-macos:
    name: Build Kotlin MacOS
    runs-on: macos-15
    steps:
    - name: Checkout
      uses: actions/checkout@v6
    - name: set up Java
      uses: actions/setup-java@v5
      with:
        distribution: temurin
        java-version: 17
    - name: set up Gradle
      uses: gradle/actions/setup-gradle@v5
    - name: Build flatc
      run: |
       cmake -DFLATBUFFERS_BUILD_TESTS=OFF -DFLATBUFFERS_BUILD_FLATLIB=OFF -DFLATBUFFERS_BUILD_FLATHASH=OFF .
       make -j
       echo "${PWD}" >> $GITHUB_PATH
    - name: Build
      working-directory: kotlin
      run: ./gradlew clean iosSimulatorArm64Test macosX64Test macosArm64Test

  build-kotlin-linux:
    name: Build Kotlin Linux
    if: false #disabled due to continual failure
    runs-on: ubuntu-24.04
    steps:
    - name: Checkout
      uses: actions/checkout@v6
    - name: set up Java
      uses: actions/setup-java@v5
      with:
        distribution: temurin
        java-version: 17
    - name: set up Gradle
      uses: gradle/actions/setup-gradle@v5
    - name: Build flatc
      run: |
       cmake -DFLATBUFFERS_BUILD_TESTS=OFF -DFLATBUFFERS_BUILD_FLATLIB=OFF -DFLATBUFFERS_BUILD_FLATHASH=OFF .
       make -j
       echo "${PWD}" >> $GITHUB_PATH
    - name: Build
      working-directory: kotlin
      # we are using docker's version of gradle
      # so no need for wrapper validation or user
      # gradlew
      run: gradle jvmMainClasses jvmTest jsTest jsBrowserTest

  build-rust-linux:
    name: Build Rust Linux
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v6
    - name: test
      working-directory: tests
      run: bash RustTest.sh

  build-rust-windows:
    name: Build Rust Windows
    runs-on: windows-2022
    steps:
    - uses: actions/checkout@v6
    - name: test
      working-directory: tests
      run: ./RustTest.bat

  build-python:
    name: Build Python
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v6
    - name: flatc
      # FIXME: make test script not rely on flatc
      run: cmake -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_BUILD_TESTS=OFF -DFLATBUFFERS_INSTALL=OFF -DFLATBUFFERS_BUILD_FLATLIB=OFF -DFLATBUFFERS_BUILD_FLATHASH=OFF -DFLATBUFFERS_STRICT_MODE=ON . && make -j
    - name: test
      working-directory: tests
      run: bash PythonTest.sh

  build-go:
    name: Build Go
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v6
    - name: flatc
      # FIXME: make test script not rely on flatc
      run: cmake -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_BUILD_TESTS=OFF -DFLATBUFFERS_INSTALL=OFF -DFLATBUFFERS_BUILD_FLATLIB=OFF -DFLATBUFFERS_BUILD_FLATHASH=OFF -DFLATBUFFERS_STRICT_MODE=ON . && make -j
    - name: test
      working-directory: tests
      run: bash GoTest.sh

  build-php:
   name: Build PHP
   runs-on: ubuntu-24.04
   steps:
   - uses: actions/checkout@v6
   - name: flatc
     # FIXME: make test script not rely on flatc
     run: cmake -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_BUILD_TESTS=OFF -DFLATBUFFERS_INSTALL=OFF -DFLATBUFFERS_BUILD_FLATLIB=OFF -DFLATBUFFERS_BUILD_FLATHASH=OFF -DFLATBUFFERS_STRICT_MODE=ON . && make -j
   - name: test
     working-directory: tests
     run: |
       php phpTest.php
       sh phpUnionVectorTest.sh

  build-swift:
    name: Test Swift Linux
    strategy:
      matrix:
        swift: ["5.10", "6.1", "6.2"]
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v6
    - uses: swift-actions/setup-swift@v2
      with:
        swift-version: ${{ matrix.swift }}
    - name: Get swift version
      run: swift --version
    - name: test
      run: swift test

  build-swift-windows:
    name: Test swift windows
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v6
      - uses: SwiftyLab/setup-swift@latest
        with:
          swift-version: '6.1'
      - run: swift build
      - run: swift test

  build-swift-wasm:
    name: Test Swift Wasm
    runs-on: ubuntu-24.04
    steps:
       - uses: actions/checkout@v6
       - uses: swift-actions/setup-swift@v2
         with:
           swift-version: 6.2.1
       - uses: bytecodealliance/actions/wasmtime/setup@v1
       - name: Install Swift SDK
         run: swift sdk install https://download.swift.org/swift-6.2.1-release/wasm-sdk/swift-6.2.1-RELEASE/swift-6.2.1-RELEASE_wasm.artifactbundle.tar.gz --checksum 482b9f95462b87bedfafca94a092cf9ec4496671ca13b43745097122d20f18af
       - name: Test
         working-directory: tests/swift/Wasm.tests
         run: |
           swift sdk list
           swift build --build-tests --swift-sdk swift-6.2.1-RELEASE_wasm
           wasmtime --dir . .build/wasm32-unknown-wasip1/debug/FlatBuffers.Test.Swift.WasmPackageTests.xctest

  build-ts:
    name: Build TS
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v6
    - name: flatc
      # FIXME: make test script not rely on flatc
      run: cmake -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_BUILD_TESTS=OFF -DFLATBUFFERS_INSTALL=OFF -DFLATBUFFERS_BUILD_FLATLIB=OFF -DFLATBUFFERS_BUILD_FLATHASH=OFF . && make -j
    - name: pnpm
      run: npm install -g pnpm
    - name: deps
      run: pnpm i
    - name: compile
      run: pnpm compile
    - name: test
      working-directory: tests/ts
      run: |
        python3 TypeScriptTest.py

  build-dart:
    name: Build Dart
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6
      - uses: dart-lang/setup-dart@v1
        with:
          sdk: stable
      - name: flatc
        # FIXME: make test script not rely on flatc
        run: cmake -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_BUILD_TESTS=OFF -DFLATBUFFERS_INSTALL=OFF -DFLATBUFFERS_BUILD_FLATLIB=OFF -DFLATBUFFERS_BUILD_FLATHASH=OFF -DFLATBUFFERS_STRICT_MODE=ON . && make -j
      - name: test
        working-directory: tests
        run: bash DartTest.sh

  build-nim:
    name: Build Nim
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@v6
    - name: flatc
      # FIXME: make test script not rely on flatc
      run: cmake -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release -DFLATBUFFERS_BUILD_TESTS=OFF -DFLATBUFFERS_INSTALL=OFF -DFLATBUFFERS_BUILD_FLATLIB=OFF -DFLATBUFFERS_BUILD_FLATHASH=OFF . && make -j
    - uses: jiro4989/setup-nim-action@v2
    - name: install library
      working-directory: nim
      run: nimble -y develop && nimble install
    - name: test
      working-directory: tests/nim
      run: python3 testnim.py

  bazel:
    name: Bazel
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6
      # Explicitly use 8.5.1 until we can update or https://github.com/actions/runner-images/issues/13564 is fixed.
      - name: Set env
        run: >
          echo "USE_BAZEL_VERSION=8.5.1" >> $GITHUB_ENV
      - name: bazel build
        run: >
          bazel build
          //:flatc
          //:flatbuffers
          //tests:flatbuffers_test
      - name: bazel test
        run: >
          bazel test
          //tests:flatbuffers_test

  release-digests:
    if: startsWith(github.ref, 'refs/tags/')
    needs: [build-linux, build-windows, build-mac-intel, build-mac-universal]
    outputs:
      digests: ${{ steps.hash.outputs.digests }}
    runs-on: ubuntu-24.04
    steps:
      - name: Merge results
        id: hash
        env:
          LINUXGCC_DIGESTS: "${{ needs.build-linux.outputs.digests-gcc }}"
          LINUXCLANG_DIGESTS: "${{ needs.build-linux.outputs.digests-clang }}"
          MAC_DIGESTS: "${{ needs.build-mac-universal.outputs.digests }}"
          MACINTEL_DIGESTS: "${{ needs.build-mac-intel.outputs.digests }}"
          WINDOWS_DIGESTS: "${{ needs.build-windows.outputs.digests }}"
        run: |
          set -euo pipefail
          echo "$LINUXGCC_DIGESTS" | base64 -d > checksums.txt
          echo "$LINUXCLANG_DIGESTS" | base64 -d >> checksums.txt
          echo "$MAC_DIGESTS" | base64 -d >> checksums.txt
          echo "$MACINTEL_DIGESTS" | base64 -d >> checksums.txt
          echo "$WINDOWS_DIGESTS" | base64 -d >> checksums.txt
          echo "digests=$(cat checksums.txt | base64 -w0)" >> $GITHUB_OUTPUT

  provenance:
    if: startsWith(github.ref, 'refs/tags/')
    needs: [release-digests]
    permissions:
      actions: read   # To read the workflow path.
      id-token: write # To sign the provenance.
      contents: write # To add assets to a release.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: "${{ needs.release-digests.outputs.digests }}"
      upload-assets: true # Optional: Upload to a new release