Update slsa-provenance.yml (#1305)

* Update slsa-provenance.yml
* Update sign-release.yml
* Update slsa-provenance.yml

Author: cure53

.github/workflows/sign-release.yml

@@ -14,7 +14,7 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-      - uses: sigstore/gh-action-sigstore-python@v3
+      - uses: sigstore/gh-action-sigstore-python@a5caf349bc536fbef3668a10ed7f5cd309a4b53d
         with:
           inputs: dist/purify.min.js dist/purify.js
       # uploads .sigstore.json bundles as release assets

.github/workflows/slsa-provenance.yml

@@ -9,8 +9,11 @@ permissions:
 jobs:
   provenance:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write    
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-      - uses: actions/attest-build-provenance@v2
+      - uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2
         with:
           subject-path: 'dist/*'