Workflows: add build provenance attestation

Author: bblanchon

.github/workflows/build-all.yml

@@ -746,6 +746,8 @@ jobs:
       - win_x86_v8
     permissions:
       contents: write # to create releases
+      id-token: write
+      attestations: write
     steps:
       - name: Download artifacts
         uses: actions/download-artifact@v4
@@ -785,3 +787,7 @@ jobs:
           name: PDFium ${{ github.event.inputs.version }}
           tag: ${{ github.event.inputs.branch }}
           artifacts: pdfium-*.tgz
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: pdfium-*.tgz

.github/workflows/build.yml

@@ -49,6 +49,8 @@ on:
 permissions:
   contents: read
   actions: write
+  id-token: write
+  attestations: write
 
 jobs:
   build:
@@ -116,10 +118,16 @@ jobs:
         run: steps/08-licenses.sh
         shell: bash
       - name: Upload artifact
+        id: upload
         uses: actions/upload-artifact@v4
         with:
           name: ${{ steps.init.outputs.artifact }}
           path: staging/
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: ${{ steps.init.outputs.artifact }}.zip
+          subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}
       - name: Test
         run: steps/09-test.sh
         shell: bash