patch: Add SLSA provenance to release assets

See https://slsa.dev/ for motivation.

Creating a patch release to ensure these additions to the automated
release process work.

Author: jmgate

.github/workflows/semantic-release.yml

@@ -39,6 +39,13 @@ jobs:
         ssh_private_signing_key: ${{ secrets.SEMANTIC_RELEASE_PRIVATE_KEY }}
         ssh_public_signing_key: ${{ secrets.SEMANTIC_RELEASE_PUBLIC_KEY }}
 
+    - name: Hash Build Artifacts
+      if: steps.release.outputs.released == 'true'
+      id: hash
+      run: |
+        cd dist
+        echo "hashes=$(find . -type f -exec sha256sum {} + | sort | base64 | tr -d '\n')" >> "$GITHUB_OUTPUT"
+
     - name: Upload Build Artifacts
       if: steps.release.outputs.released == 'true'
       uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
@@ -47,13 +54,28 @@ jobs:
         path: dist/
 
     outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
       released: ${{ steps.release.outputs.released }}
 
-  publish:
-    runs-on: ubuntu-latest
+  provenance:
     needs: release
     if: ${{ needs.release.outputs.released == 'true' }}
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+    with:
+      base64-subjects: "${{ needs.release.outputs.hashes }}"
+
+  publish:
+    runs-on: ubuntu-latest
+    needs: [release, provenance]
+    if: ${{ needs.release.outputs.released == 'true' && needs.provenance.outputs.outcome == 'success' }}
     environment: release
+    permissions:
+      id-token: write
+
     steps:
     - name: Harden Runner
       uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
@@ -65,16 +87,25 @@ jobs:
         fetch-depth: 0
         token: ${{ secrets.GH_TOKEN }}
 
-    - name: Download Artifacts
+    - name: Download Build Artifacts
       uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: dist
         path: dist
 
-    - name: Publish to PyPI
-      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1
+    - name: Download Provenance
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      with:
+        name: ${{ needs.provenance.outputs.provenance-name }}
+        path: dist
 
     - name: Publish to GitHub Releases
       uses: python-semantic-release/publish-action@b717f67f7e7e9f709357bce5a542846503ce46ec # v10.2.0
       with:
         github_token: ${{ secrets.GH_TOKEN }}
+
+    - name: Remove Provenance for PyPI Upload
+      run: rm -f dist/${{ needs.provenance.outputs.provenance-name }}
+
+    - name: Publish to PyPI
+      uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1