Test cosign

Author: spalmurray

.github/workflows/build.yml

@@ -165,12 +165,22 @@ jobs:
     name: Package assets for Craft
     runs-on: ubuntu-latest
     needs: [build_for_pypi, build_assets, build_linux_assets]
+    permissions:
+      id-token: write # needed for signing binaries with OIDC token via Cosign
     steps:
       - name: Download artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           pattern: "{sentry-prevent-,codecov-,codecov}cli*"
 
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
+
+      - name: Sign sentry-prevent-cli binaries
+        run: cosign sign-blob sentry-prevent-cli_macos/sentry-prevent-cli_macos --bundle sentry-prevent-cli_macos.bundle --yes
+
+      - run: ls
+
       - name: Upload release artifact
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
@@ -180,3 +190,4 @@ jobs:
             sentry-prevent-cli_wheel/*
             codecovcli*
             codecov-cli_wheel/*
+            *.bundle