ci: add Sigstore signing and signed GitHub release artifacts for PyPI releases (hiero-ledger#2054)

Signed-off-by: Daniel Ntege <danientege785@gmail.com>
Signed-off-by: Ntege Daniel <danientege785@gmail.com>

Author: danielmarv

.github/workflows/publish.yml

@@ -9,13 +9,10 @@ permissions:
   contents: read
 
 jobs:
-  build-and-publish:
+  build:
+    name: Build distributions
     runs-on: hl-sdk-py-lin-md
-    environment:
-      name: pypi
-      url: https://pypi.org/p/hiero-sdk-python
-    permissions:
-      id-token: write
+
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
@@ -44,5 +41,64 @@ jobs:
       - name: Build wheel and sdist
         run: python -m build
 
+      - name: Upload distributions
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: dist
+          path: dist/*
+          if-no-files-found: error
+
+  publish-and-sign:
+    name: Publish and sign release artifacts
+    needs: build
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: false
+    runs-on: hl-sdk-py-lin-md
+    environment:
+      name: pypi
+      url: https://pypi.org/p/hiero-sdk-python
+    permissions:
+      contents: write
+      id-token: write
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@f808768d1510423e83855289c910610ca9b43176 # v2.17.0
+        with:
+          egress-policy: audit
+
+      - name: Download distributions
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: dist
+          path: dist
+
+      - name: Sign release distributions with Sigstore
+        uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0
+        with:
+          inputs: |
+            dist/*.whl
+            dist/*.tar.gz
+          verify: true
+          verify-cert-identity: https://github.com/${{ github.repository }}/.github/workflows/publish.yml@refs/tags/${{ github.ref_name }}
+          verify-oidc-issuer: https://token.actions.githubusercontent.com
+
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
+        with:
+          skip-existing: true
+
+      - name: Upload signed assets to GitHub Release
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        with:
+          body: |
+            ## Important notes
+            - See https://github.com/hiero-ledger/hiero-sdk-python/milestones for the pull requests included in this milestone.
+            - This release includes auto-generated release notes.
+          files: |
+            dist/*.whl
+            dist/*.tar.gz
+            dist/*.sigstore.json
+          fail_on_unmatched_files: true
+          generate_release_notes: true

RELEASE.md

@@ -19,22 +19,23 @@ MAJOR.MINOR.PATCH
 1. **Update the Version**
    Decide whether the changes are major, minor, or patch increments.
 
-2. **Update the Changelog**
-   Move your entries from the **[Unreleased]** section in `CHANGELOG.md` to a new version heading with today’s date (e.g., `## [0.2.0] - 2025-02-20`).
-
-3. **Create a Release Branch**
-   - `release-v0.2.0` or similar (e.g., `release-v0.2.0-beta.1` for beta versions).
-
-4. **Run Tests**
+2. **Run Tests**
    - Ensure all tests pass locally (run `pytest`).
    - Confirm CI passes (integration tests, etc.).
 
-5. **Merge into `main`**
-   - Create a Pull Request from `release-vX.X.X` into `main`.
-   - Wait for code review, ensure everything is green.
+3. **Tag the Release**
+   Once the release changes are merged, create and push a git tag that matches the publish workflow trigger (`v*.*.*`):
 
-6. **Tag the Release**
-   Once merged, create a git tag with the new version:
    ```bash
    git tag -a v0.2.0 -m "Release 0.2.0"
    git push origin v0.2.0
+   ```
+
+4. **Monitor the Publish Workflow**
+   - The `.github/workflows/publish.yml` workflow runs automatically when the tag is pushed.
+   - The workflow builds the source distribution and wheel, generates protobufs before packaging, signs the release artifacts with Sigstore, publishes the package to PyPI, and creates or updates the GitHub release.
+
+5. **Verify Published Artifacts**
+   - Confirm the new version is available on PyPI.
+   - Confirm the GitHub release contains the wheel, source distribution, and matching `.sigstore.json` bundles.
+   - If release provenance needs to be audited, use the Sigstore verification materials attached to the GitHub release.