Add GitHub artifact attestations to release workflow

[shaanmajid]

Closes #1493

Adds actions/attest-build-provenance to the release workflow so consumers can verify artifacts were built by CI:

gh attestation verify <artifact> --repo j178/prek

GitHub already generates release attestations that verify file integrity (checksums), but build provenance additionally proves the artifacts were produced by the CI workflow rather than uploaded manually.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.51%. Comparing base (7640685) to head (1e015f5).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1494   +/-   ##
=======================================
  Coverage   91.51%   91.51%           
=======================================
  Files          87       87           
  Lines       18153    18153           
=======================================
  Hits        16612    16612           
  Misses       1541     1541           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[prek-ci-bot]

📦 Cargo Bloat Comparison

Binary size change: +0.00% (22.5 MiB → 22.5 MiB)

Expand for cargo-bloat output

Head Branch Results

 File  .text    Size           Crate Name
 0.3%   0.8% 71.7KiB           prek? <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
 0.3%   0.6% 59.5KiB            prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.2%   0.6% 56.1KiB            prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.2%   0.5% 43.4KiB            prek prek::identify::by_extension::{{closure}}
 0.2%   0.5% 43.3KiB            prek prek::run::{{closure}}
 0.2%   0.4% 41.5KiB            prek prek::cli::run::run::run::{{closure}}
 0.2%   0.4% 40.8KiB            prek prek::languages::<impl prek::config::Language>::install::{{closure}}
 0.1%   0.3% 31.8KiB           prek? <prek::cli::RunArgs as clap_builder::derive::Args>::augment_args
 0.1%   0.2% 21.6KiB            prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2% 21.0KiB    clap_builder clap_builder::parser::parser::Parser::get_matches_with
 0.1%   0.2% 20.8KiB            prek prek::archive::unzip::{{closure}}
 0.1%   0.2% 20.0KiB cargo_metadata? <cargo_metadata::_::<impl serde_core::de::Deserialize for cargo_metadata::Package>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map
 0.1%   0.2% 19.4KiB            prek prek::cli::run::filter::collect_files_from_args::{{closure}}
 0.1%   0.2% 19.4KiB            prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2% 19.4KiB            prek prek::cli::run::filter::collect_files_from_args::{{closure}}
 0.1%   0.2% 19.3KiB            prek <prek::languages::ruby::ruby::Ruby as prek::languages::LanguageImpl>::install::{{closure}}
 0.1%   0.2% 18.6KiB            ring ring_core_0_17_14__x25519_ge_frombytes_vartime
 0.1%   0.2% 18.5KiB            prek prek::hook::HookBuilder::build::{{closure}}
 0.1%   0.2% 18.5KiB            prek prek::hook::HookBuilder::build::{{closure}}
 0.1%   0.2% 18.5KiB            prek prek::hook::HookBuilder::build::{{closure}}
36.9%  91.6%  8.3MiB                 And 20033 smaller methods. Use -n N to show more.
40.2% 100.0%  9.1MiB                 .text section size, the file size is 22.5MiB

Base Branch Results

 File  .text    Size           Crate Name
 0.3%   0.8% 71.7KiB           prek? <prek::cli::Command as clap_builder::derive::Subcommand>::augment_subcommands
 0.3%   0.6% 59.5KiB            prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.2%   0.6% 56.1KiB            prek prek::languages::<impl prek::config::Language>::run::{{closure}}::{{closure}}
 0.2%   0.5% 43.4KiB            prek prek::identify::by_extension::{{closure}}
 0.2%   0.5% 43.3KiB            prek prek::run::{{closure}}
 0.2%   0.4% 41.5KiB            prek prek::cli::run::run::run::{{closure}}
 0.2%   0.4% 40.8KiB            prek prek::languages::<impl prek::config::Language>::install::{{closure}}
 0.1%   0.3% 31.8KiB           prek? <prek::cli::RunArgs as clap_builder::derive::Args>::augment_args
 0.1%   0.2% 21.6KiB            prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2% 21.0KiB    clap_builder clap_builder::parser::parser::Parser::get_matches_with
 0.1%   0.2% 20.8KiB            prek prek::archive::unzip::{{closure}}
 0.1%   0.2% 20.0KiB cargo_metadata? <cargo_metadata::_::<impl serde_core::de::Deserialize for cargo_metadata::Package>::deserialize::__Visitor as serde_core::de::Visitor>::visit_map
 0.1%   0.2% 19.4KiB            prek prek::cli::run::filter::collect_files_from_args::{{closure}}
 0.1%   0.2% 19.4KiB            prek prek::hooks::meta_hooks::MetaHooks::run::{{closure}}
 0.1%   0.2% 19.4KiB            prek prek::cli::run::filter::collect_files_from_args::{{closure}}
 0.1%   0.2% 19.3KiB            prek <prek::languages::ruby::ruby::Ruby as prek::languages::LanguageImpl>::install::{{closure}}
 0.1%   0.2% 18.6KiB            ring ring_core_0_17_14__x25519_ge_frombytes_vartime
 0.1%   0.2% 18.5KiB            prek prek::hook::HookBuilder::build::{{closure}}
 0.1%   0.2% 18.5KiB            prek prek::hook::HookBuilder::build::{{closure}}
 0.1%   0.2% 18.5KiB            prek prek::hook::HookBuilder::build::{{closure}}
36.9%  91.6%  8.3MiB                 And 20033 smaller methods. Use -n N to show more.
40.2% 100.0%  9.1MiB                 .text section size, the file size is 22.5MiB

[j178]

Thanks! I think it would also be great to add attestation for our build-docker.yml as well.

[shaanmajid]

Ah, I missed that. I'll make a follow up PR :)