feat: add SLSA provenance attestations to publish workflow

[bhuvan-somisetty]

Summary

Fixes #2235

Recent releases included Sigstore signatures but lacked SLSA/in-toto provenance attestations, causing verification tooling to warn that "release artifact does not have provenance". This PR resolves the supply-chain security gap.

Changes

All changes are confined to .github/workflows/publish.yml:

• Add attestations: write permission to the publish-and-sign job so the workflow can upload provenance to GitHub's Attestations API
• Add actions/attest-build-provenance step after artifact download to generate SLSA provenance for both .whl and .tar.gz artifacts (SHA-pinned following existing workflow conventions)
• Explicitly enable attestations: true in pypa/gh-action-pypi-publish to ensure PEP 740 attestations are uploaded to PyPI alongside the package

Verification

After merging, the next release can be verified with:

gh attestation verify hiero_sdk_python-<version>-py3-none-any.whl \
  --repo hiero-ledger/hiero-sdk-python

Test plan

• CI passes on this PR
• On next tag release, gh attestation verify returns no warnings
• PyPI package page shows attestation badge

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: ab368e06-f397-46ed-9293-f0e4ba66951d

📥 Commits

Reviewing files that changed from the base of the PR and between f768adf and 9d401f4.

📒 Files selected for processing (1)

• .github/workflows/publish.yml

---

Walkthrough

The publish workflow is extended to generate and publish build provenance attestations for distribution artifacts (wheels and source distributions) alongside existing Sigstore signatures, addressing supply-chain integrity concerns.

Changes

Build Provenance Attestations

Layer / File(s)	Summary
Permissions .github/workflows/publish.yml	Add attestations: write permission to the publish-and-sign job to enable provenance attestation generation.
Attestation Generation .github/workflows/publish.yml	Insert step that invokes actions/attest-build-provenance with dist/*.whl and dist/*.tar.gz as subjects to generate SLSA/in-toto provenance.
PyPI Integration .github/workflows/publish.yml	Enable attestations during PyPI publish by setting attestations: true on the pypi-publish action.

sequenceDiagram
  participant Runner as GitHub Actions runner
  participant PublishJob as publish-and-sign job
  participant ActionsAttest as actions/attest
  participant PyPIPublish as pypa/gh-action-pypi-publish
  participant PyPI as PyPI registry

  Runner->>PublishJob: start publish-and-sign job
  PublishJob->>ActionsAttest: Generate build provenance for dist/*.whl, dist/*.tar.gz
  ActionsAttest->>PublishJob: return provenance attestations
  PublishJob->>PyPIPublish: invoke publish step with attestations: true
  PyPIPublish->>PyPI: upload package and attach attestations

Loading

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely summarizes the main change: adding SLSA provenance attestations to the publish workflow.
Description check	✅ Passed	The description is well-detailed and directly related to the changeset, explaining the supply-chain security gap and how the changes resolve it.
Linked Issues check	✅ Passed	The changes fully address issue #2235 by adding SLSA/in-toto provenance attestations to the publish workflow, fixing the missing provenance gap.
Out of Scope Changes check	✅ Passed	All changes are confined to .github/workflows/publish.yml and directly address the linked issue #2235 requirements for adding provenance attestations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

📋 Issue Planner

Built with CodeRabbit's Coding Plans for faster development and fewer bugs.

View plan used: #2235

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Hello, this is the OfficeHourBot.

This is a reminder that the Hiero Python SDK Office Hours are scheduled in approximately 4 hours (14:00 UTC).

This session provides an opportunity to ask questions regarding this Pull Request.

Details:

• Time: 14:00 UTC
• Join Link: Zoom Meeting

Disclaimer: This is an automated reminder. Please verify the schedule here for any changes.

From,
The Python SDK Team

[exploreriii]

https://github.com/actions/attest-build-provenance

[exploreriii]

As of version 4, actions/attest-build-provenance is simply a wrapper on top of actions/attest.

Existing applications may continue to use the attest-build-provenance action, but new implementations should use actions/attest instead. Please see the actions/attest repository for usage information.

[bhuvan-somisetty]

Thanks for the review. I updated the workflow to use actions/attest directly instead of actions/attest-build-provenance, and kept it SHA-pinned following the existing workflow convention.

[Copilot]

Pull request overview

This PR updates the release publishing workflow to generate and upload SLSA/in-toto provenance attestations for built Python artifacts, addressing verification warnings about missing provenance (Fixes #2235).

Changes:

• Adds attestations: write permission to the publish-and-sign job.
• Adds an attestation step intended to generate provenance for dist/*.whl and dist/*.tar.gz.
• Enables PyPI-side PEP 740 attestations via pypa/gh-action-pypi-publish (attestations: true).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[exploreriii]

Hi i was looking at the documentation

Some ideas - move attestation into right after build because that job creates dist/.whl and dist/.tar.gz; attesting there gives cleaner provenance. Add artifact-metadata: write there to due to the newer actions/attest permission expectations. After that, remove attestations: write from publish-and-sign because it no longer generates attestations.

Also please check if this would fail without artifact-metadata
https://github.com/actions/attest

and
"Add the following to your workflow after your artifact has been built:"

[aceppaluni]

@bhuvan-somisetty This is looking good. Thank you for adding this.

Happy to review again when changes are applied.

[aceppaluni]

Can you update your branch when you have a moment? From there we can run the workflows

[aceppaluni]

Can you update the branch again, thank you

[github-actions]

Hi, this is WorkflowBot.
Your pull request cannot be merged as it is not passing all our workflow checks.
Please click on each check to review the logs and resolve issues so all checks pass.
To help you:

• DCO signing guide
• Merge conflicts guide
• Rebase guide
• Testing guide
• Discord
• Community Calls
  Thank you for contributing!
  From the Hiero Python SDK Team

[manishdait]

@bhuvan-somisetty, Thanks for the PR, Can you update the branch again

updated branch

[github-actions]

👋 Hi @bhuvan-somisetty! Great work completing a Intermediate issue! 🎉

Thanks for your contribution! 🚀

🏆 Milestone unlocked: you've reached Advanced level! 🎉

Here are some issues you might want to explore next:

• [Advanced]: Integrate Code Coverage for C++ SDK

🌟 Stay connected:

• ⭐ Star this repository
• 👀 Watch for new issues
• 💬 Join us on Discord

Happy coding! 🚀
— Hiero Python SDK Team