ci: provenance

Author: drainpixie

.github/workflows/cd-publish.yml

@@ -2,10 +2,8 @@ name: "CD: Build & Publish"
 
 # TODO: Notify
 # TODO: Publish to PyPI
-# TODO: Generate provenance/hashes
 
 on:
-  # TODO: Remove after finished; for testing purposes only
   pull_request:
   workflow_dispatch:
     inputs:
@@ -68,6 +66,10 @@ jobs:
     name: Build Artifacts
     runs-on: ubuntu-latest
     needs: [version]
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
     steps:
       - name: "[INIT] Checkout"
         uses: actions/checkout@v5
@@ -88,29 +90,32 @@ jobs:
 
       - name: "[BUILD] Wheel"
         run: |
+          mkdir -p dist
           nix build -L .#wheel
-          cp result/*.whl ./
+          cp result/*.whl dist/
+
 
       - name: "[BUILD] Source dist"
         run: |
           nix build -L .#sdist
-          cp result/*.tar.gz ./
+          cp result/*.tar.gz dist/
 
       - name: "[CHANGELOG] Generate release notes"
         run: |
           nix develop --command git-cliff -c cliff.toml \
             --unreleased --verbose \
-            -o RELEASE_NOTES.md
+            -o dist/RELEASE_NOTES.md
 
+      - name: "[VERIFY] Provenance"
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: 'dist/*'
 
       - name: "[UPLOAD] Artifacts"
         uses: actions/upload-artifact@v4
         with:
           name: dist-artifacts
-          path: |
-            *.whl
-            *.tar.gz
-            RELEASE_NOTES.md
+          path: dist/
           if-no-files-found: error
 
   github-release:
@@ -145,8 +150,6 @@ jobs:
           tag_name: ${{ steps.input.outputs.tag }}
           prerelease: ${{ steps.input.outputs.prerelease }}
           body_path: dist/RELEASE_NOTES.md
-          files: |
-            dist/*.whl
-            dist/*.tar.gz
+          files: dist/*
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}