Attest built artifacts

[llucax]

What's needed?

GitHub has a new option to add artifact attestation to establish provenance for builds and we should use it.

Proposed solution

Add an extra step to attest the generated files:

- name: Generate artifact attestation
  uses: actions/attest-build-provenance@v1
  with:
    subject-path: 'PATH/TO/ARTIFACT'

Use cases

• Generated docs
• Generated Python wheels and source distribution files

Alternatives and workarounds

No response

Additional context

• https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
• https://newsblur.com/site/8683141/github-blog