feat: make build reproducible and use attestations

Author: sentriz

.github/workflows/repro.yaml

@@ -0,0 +1,27 @@
+name: Reproducible build
+on:
+  workflow_dispatch:
+jobs:
+  build:
+    name: Build and attest
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Checkout submodules
+        run: git submodule update --init --recursive
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Build taglib.wasm
+        run: |
+          rm taglib.wasm
+          ./build/build-docker.sh
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: |
+            taglib.wasm

README.md

@@ -4,6 +4,8 @@ This project is a Go library for reading and writing audio metadata tags. By pac
 
 Current bundled TagLib version is [v2.1.1](https://github.com/taglib/taglib/releases/tag/v2.1.1).
 
+To reproduce or verify the bundled binary, see the [attestations](https://github.com/sentriz/go-taglib/attestations/).
+
 [![godoc](https://img.shields.io/badge/pkg.go.dev-doc-blue)](http://pkg.go.dev/go.senan.xyz/taglib)
 
 ## Features

build/build-docker.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env sh
 
+set -e
+
 image="go-taglib-build"
 
 docker build -t "$image" "./build"

build/build.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env sh
 
+set -e
+
 wasi_loc="$1"
 if [ -z "$wasi_loc" ]; then
     echo "please provide <wasi loc>" >&2