Attest package provenance

This uses the new build provenance support added in [build-and-inspect-python-package 2.5.0](https://github.com/hynek/build-and-inspect-python-package/blob/main/CHANGELOG.md#250---2024-05-13).

More information: https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/

Tested also in pytest-dev/pytest-mock#431.

Note: even though it is technically necessary only for the `deploy` workflow, as the `test` workflow does not publish its packages, decided to always attest the provenance in both cases to avoid any surprises related to this (say a misconfiguration) when deploying.

.github/workflows/deploy.yml

@@ -18,6 +18,11 @@ jobs:
     env:
       SETUPTOOLS_SCM_PRETEND_VERSION: ${{ github.event.inputs.version }}
     timeout-minutes: 10
+
+    # Required by attest-build-provenance-github.
+    permissions:
+      id-token: write
+      attestations: write
 
     steps:
     - uses: actions/checkout@v4
@@ -26,7 +31,9 @@ jobs:
         persist-credentials: false
 
     - name: Build and Check Package
-      uses: hynek/[email protected]
+      uses: hynek/[email protected]
+      with:
+        attest-build-provenance-github: 'true'
 
   deploy:
     if: github.repository == 'pytest-dev/pytest'

.github/workflows/test.yml

@@ -29,13 +29,19 @@ permissions: {}
 jobs:
   package:
     runs-on: ubuntu-latest
+    # Required by attest-build-provenance-github.
+    permissions:
+      id-token: write
+      attestations: write
     steps:
     - uses: actions/checkout@v4
       with:
         fetch-depth: 0
         persist-credentials: false
     - name: Build and Check Package
-      uses: hynek/[email protected]
+      uses: hynek/[email protected]
+      with:
+        attest-build-provenance-github: 'true'
 
   build:
     needs: [package]