{#- OZI
# ozi/templates/.github/workflows/provenance.yml
# SPDX-License-Identifier: MIT-0
#}
  provenance:
    needs: [draft, release]
    runs-on: ubuntu-latest
    name: Generate build provenance
    if: needs.draft.outputs.drafted == 'true'
    permissions:
      contents: write
      id-token: write
      attestations: write
    steps:
{%- if project.github_harden_runner %}
{% include ".github/workflows/harden_runner.yml.j2" %}
        allowed-endpoints: >
        {%- for endpoint in spec.python.ci.github.harden_runner.endpoints.provenance.split(' ') %}
            {{ endpoint }}
        {%- endfor %}
{%- endif %}
    - uses: OZI-Project/provenance@{{ spec.python.ci.github.provenance.version }}
      with:
{%- raw %}
        release-tag: ${{ needs.draft.outputs.tag }}
{%- endraw %}