Perform artifact attestation

.github/workflows/bindgen.yml

@@ -13,5 +13,7 @@ jobs:
       crate: bindgen-cli
       bin: bindgen
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/buckle.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: buckle
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/build.yml

@@ -38,7 +38,9 @@ jobs:
     name: ${{inputs.crate}}
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v4
@@ -63,6 +65,9 @@ jobs:
       - run: gpg --output ${{inputs.bin || inputs.crate}}.sig --detach-sig ${{steps.which.outputs.which}}
       - run: gpg --output signing-key.gpg --dearmor signing-key.asc
       - run: gpg --no-default-keyring --keyring ./signing-key.gpg --verify ${{inputs.bin || inputs.crate}}.sig ${{steps.which.outputs.which}}
+      - uses: actions/attest-build-provenance@v2
+        with:
+          subject-path: ${{steps.which.outputs.which}}
       - run: git tag -d ${{inputs.crate}} || true
       - run: git tag ${{inputs.crate}}
       - run: git push origin tag ${{inputs.crate}} --force

.github/workflows/cargo-afl.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: cargo-afl
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/cargo-bloat.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: cargo-bloat
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/cargo-docs-rs.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: cargo-docs-rs
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/cargo-expand.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: cargo-expand
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/cargo-fuzz.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: cargo-fuzz
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/cargo-llvm-lines.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: cargo-llvm-lines
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/cargo-outdated.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: cargo-outdated
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/cargo-tally.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: cargo-tally
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/cargo-unlock.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: cargo-unlock
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/cargo-web.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: cargo-web
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/cbindgen.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: cbindgen
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/cxxbridge-cmd.yml

@@ -13,5 +13,7 @@ jobs:
       crate: cxxbridge-cmd
       bin: cxxbridge
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/dircnt.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: dircnt
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/dotslash.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: dotslash
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/faketty.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: faketty
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/honggfuzz.yml

@@ -13,5 +13,7 @@ jobs:
       crate: honggfuzz
       bin: cargo-hfuzz
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/mdbook.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: mdbook
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/reindeer.yml

@@ -13,5 +13,7 @@ jobs:
       crate: reindeer
       git: facebookincubator/reindeer
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/rustup-toolchain-install-master.yml

@@ -14,5 +14,7 @@ jobs:
       git: dtolnay-contrib/rustup-toolchain-install-master
       ref: nodefault
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/sha1dir.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: sha1dir
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/star-history.yml

@@ -12,5 +12,7 @@ jobs:
     with:
       crate: star-history
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit

.github/workflows/taplo-cli.yml

@@ -14,5 +14,7 @@ jobs:
       bin: taplo
       locked: true
     permissions:
+      id-token: write
       contents: write
+      attestations: write
     secrets: inherit