build(attestation): 👷 attest build provenance on release (#616)

Closes #615

.github/workflows/build.yaml

@@ -12,6 +12,10 @@ on:
       release_version:
         description: The release version to use for the build
         type: string
+      sign:
+        description: Whether to sign the artifact
+        type: boolean
+        default: true
     outputs:
       release_version:
         description: The release version that was used for the build
@@ -26,6 +30,10 @@ on:
       release_version:
         description: The release version to use for the build
         type: string
+      sign:
+        description: Whether to sign the artifact
+        type: boolean
+        default: true
 
 
 concurrency:
@@ -68,3 +76,4 @@ jobs:
       suffix: ${{ matrix.suffix }}
       run_tests: ${{ matrix.run_tests }}
       extra_test_containers: ${{ matrix.extra_test_containers }}
+      sign: ${{ inputs.sign }}

.github/workflows/release.yaml

@@ -4,6 +4,8 @@ run-name: Releasing ${{ github.ref }}
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 
 on:
@@ -55,6 +57,7 @@ jobs:
     with:
       git_sha: ${{ github.sha }}
       release_version: ${{ needs.prepare-release-version.outputs.release_version }}
+      sign: true
 
 
   create-release:
@@ -112,6 +115,11 @@ jobs:
           excludeTypes: build,docs,other,style,chore,test,tests,refactor
           writeToFile: false
 
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: '/tmp/binaries/**/*'
+
       - name: Create release
         uses: softprops/action-gh-release@v2
         with:

.github/workflows/tests.yaml

@@ -123,6 +123,7 @@ jobs:
     with:
       git_sha: ${{ github.sha }}
       release_version: ${{ needs.prepare-release-version.outputs.release_version }}
+      sign: false
 
 
   rust-clippy-analysis: