Use GItHub attestations to check for signed releases

[edgarrmondragon]

Is your feature request related to a problem? Please describe.

As seen in https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/.

Describe the solution you'd like

Check artifact signatures in a repo's https://github.com/<org>/<repo>/attestations URL.

Describe alternatives you've considered

Continue using the current Signed Releases check.

Additional context

[spencerschrock]

This is on our radar. Some signals we may look for in a repo:

• attestations: write permission
• uses: actions/attest-build-provenance and checking the claimed subject-path against the release artifacts.

[edgarrmondragon]

fwiw actions/attest-build-provenance can produce an in-toto JSON file that can be uploaded to the release with a *.intoto.jsonl asset name, so this is already kinda supported.

(example in edgarrmondragon/citric#1132)

[github-actions]

This issue has been marked stale because it has been open for 60 days with no activity.

[edgarrmondragon]

I think this is still relevant?

[github-actions]

This issue has been marked stale because it has been open for 60 days with no activity.