feat: add SLSA provenance attestations to publish workflow

- Add attestations: write permission to publish-and-sign job

- Add actions/attest step for wheel and sdist artifacts

- Explicitly enable PEP 740 attestations in pypa/gh-action-pypi-publish

Fixes #2235

Signed-off-by: bhuvan-somisetty <somisettybhuvan5@gmail.com>

Author: bhuvan-somisetty

.github/workflows/publish.yml

@@ -59,6 +59,7 @@ jobs:
     permissions:
       contents: write
       id-token: write
+      attestations: write
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -77,6 +78,13 @@ jobs:
           name: dist
           path: dist
 
+      - name: Generate build provenance attestations
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: |
+            dist/*.whl
+            dist/*.tar.gz
+
       - name: Sign release distributions with Sigstore
         uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0
         with:
@@ -98,6 +106,7 @@ jobs:
         with:
           packages-dir: publish-dist
           skip-existing: true
+          attestations: true
 
       - name: Upload signed assets to GitHub Release
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0