patch: Add SLSA provenance to release assets

See https://slsa.dev/ for motivation.

Creating a patch release to ensure these additions to the automated
release process work.

Closes #260.

Author: jmgate

.github/workflows/semantic-release.yml

@@ -39,6 +39,13 @@ jobs:
         ssh_private_signing_key: ${{ secrets.SEMANTIC_RELEASE_PRIVATE_KEY }}
         ssh_public_signing_key: ${{ secrets.SEMANTIC_RELEASE_PUBLIC_KEY }}
 
+    - name: Hash Build Artifacts
+      if: steps.release.outputs.released == 'true'
+      id: hash
+      run: |
+        cd dist
+        echo "hashes=$(find . -type f -exec sha256sum {} + | sort | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT"
+
     - name: Upload Build Artifacts
       if: steps.release.outputs.released == 'true'
       uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
@@ -47,12 +54,24 @@ jobs:
         path: dist/
 
     outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
       released: ${{ steps.release.outputs.released }}
 
-  publish:
-    runs-on: ubuntu-latest
+  provenance:
     needs: release
     if: ${{ needs.release.outputs.released == 'true' }}
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
+    with:
+      base64-subjects: "${{ needs.release.outputs.hashes }}"
+
+  publish:
+    runs-on: ubuntu-latest
+    needs: [release, provenance]
+    if: ${{ needs.release.outputs.released == 'true' && needs.provenance.outputs.outcome == 'success' }}
     environment: release
     steps:
     - name: Harden Runner
@@ -65,12 +84,18 @@ jobs:
         fetch-depth: 0
         token: ${{ secrets.GH_TOKEN }}
 
-    - name: Download Artifacts
+    - name: Download Build Artifacts
       uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: dist
         path: dist
 
+    - name: Download Provenance
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      with:
+        name: ${{ needs.provenance.outputs.provenance-name }}
+        path: dist
+
     - name: Publish to PyPI
       uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1