github-action: provenance generation

[v1v]

What does this pull request do?

Use https://github.com/github-early-access/generate-build-provenance to create build attestations

Test

Using a test feature branch and skip upload artifacts or slack notifications:

• release -> https://github.com/elastic/apm-agent-dotnet/actions/runs/9399719545
• release-main -> https://github.com/elastic/apm-agent-dotnet/actions/runs/9399719549/job/25887752695

diff --git a/.github/workflows/release-main.yml b/.github/workflows/release-main.yml
index d0ef4f1a..b8ec9e29 100644
--- a/.github/workflows/release-main.yml
+++ b/.github/workflows/release-main.yml
@@ -2,7 +2,7 @@ name: release-main
 
 on:
   push:
-    branches: [ "main" ]
+    branches: [ "main", "test/provenance" ]
 
 permissions:
   attestations: write
@@ -36,12 +36,14 @@ jobs:
 
     # Github packages requires authentication, this is likely going away in the future so for now we publish to feedz.io
     - name: publish canary packages to feedz.io
+      if: startsWith(github.ref, 'refs/tags')
       run: dotnet nuget push 'build/output/_packages/*.nupkg' -k ${{ secrets.FEEDZ_IO_API_KEY }} -s ${{ secrets.FEEDZ_IO_API_URL }} --skip-duplicate --no-symbols
       
     - name: publish canary packages github package repository
+      if: startsWith(github.ref, 'refs/tags')
       run: dotnet nuget push 'build/output/_packages/*.nupkg' -k ${{secrets.GITHUB_TOKEN}} -s https://nuget.pkg.github.com/elastic/index.json --skip-duplicate --no-symbols
     
-    - if: ${{ failure() }}
+    - if: ${{ failure() && startsWith(github.ref, 'refs/tags') }}
       uses: elastic/oblt-actions/slack/[email protected]
       with:
         bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4933a4c4..576d9215 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,6 +3,8 @@ name: release
 on:
   release:
     types: [published]
+  push:
+    branches: [ "test/provenance" ]
 
 permissions:
   contents: write
@@ -39,6 +41,7 @@ jobs:
       run: ./build.sh pack
 
     - name: Release to Nuget
+      if: startsWith(github.ref, 'refs/tags')
       run: .ci/linux/deploy.sh ${{ secrets.NUGET_API_KEY }} ${{ secrets.NUGET_API_URL }}
 
     - name: Set up Docker Buildx
@@ -97,13 +100,14 @@ jobs:
         subject-path: "${{ github.workspace }}/${{ env.PREFIX_APM_PROFILER }}${{ steps.bootstrap.outputs.agent-version }}${{ env.SUFFIX_APM_PROFILER }}"
 
     - name: Attach Profiler And Startup Hooks
+      if: startsWith(github.ref, 'refs/tags')
       continue-on-error: true #continue for now until we see it working in action
       env:
         GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: |
         gh release upload ${{ github.ref_name }} "${{ env.PREFIX_APM_AGENT }}${{ steps.bootstrap.outputs.agent-version }}${{ env.SUFFIX_APM_AGENT }}" "${{ env.PREFIX_APM_PROFILER }}${{ steps.bootstrap.outputs.agent-version }}${{ env.SUFFIX_APM_PROFILER }}"
 
-    - if: ${{ success() }}
+    - if: ${{ success() && startsWith(github.ref, 'refs/tags') }}
       uses: elastic/oblt-actions/slack/[email protected]
       with:
         bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
@@ -113,7 +117,7 @@ jobs:
           Build: (<${{ env.JOB_URL }}|here>)
           Release URL: (<https://github.com/elastic/apm-agent-dotnet/releases/tag/${{ github.ref_name }}|${{ github.ref_name }}>)
 
-    - if: ${{ failure() }}
+    - if: ${{ failure() && startsWith(github.ref, 'refs/tags') }}
       uses: elastic/oblt-actions/slack/[email protected]
       with:
         bot-token: ${{ secrets.SLACK_BOT_TOKEN }}
@@ -152,6 +156,7 @@ jobs:
           subject-path: "${{ github.workspace }}/${{ env.PREFIX_ZIP_FILE }}${{ steps.bootstrap.outputs.agent-version }}${{ env.SUFFIX_ZIP_FILE }}"
 
       - name: Attach Profiler
+        if: startsWith(github.ref, 'refs/tags')
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         continue-on-error: true #continue for now until we see it working in action
@@ -161,6 +166,7 @@ jobs:
   post-release:
     needs: [ 'release-windows']
     runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags')
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       GIT_TAG: v${{ needs.release-windows.outputs.agent-version }}

[v1v]

run docs-build

[v1v]

I'll test this in isolation to validate things work as expected after the merge I ran recently

[v1v]

All good now, it took me a while to verify things worked nice/smoothly... so I feel we are now in a good position to merge this PR.

[Mpdreamz]

Lgtm merge at will :)