name: Reproducible build

on:
  workflow_dispatch:

permissions:
  contents: read
  id-token: write
  attestations: write

jobs:
  build:
    strategy:
      matrix:
        os: [macos-latest, ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}

    steps:
    - uses: ilammy/msvc-dev-cmd@v1
    - uses: actions/checkout@v4

    - name: Build
      shell: bash
      run: .github/workflows/repro.sh

    - uses: actions/attest-build-provenance@v2
      if: matrix.os == 'ubuntu-latest'
      with:
        subject-path: |
          embed/sqlite3.wasm
          embed/bcw2/bcw2.wasm
          util/sql3util/wasm/sql3parse_table.wasm