Attest package provenance

[nicoddemus]

This uses the new build provenance support added in build-and-inspect-python-package 2.5.0.

More information: https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/

Tested also in pytest-dev/pytest-mock#431.

Note: even though it is technically necessary only for the deploy workflow, as the test workflow does not publish its packages, decided to always attest the provenance in both cases to avoid any surprises related to this (say a misconfiguration) when deploying.

[nicoddemus]

Provenance information created: https://github.com/pytest-dev/pytest/actions/runs/9111218324/attempts/1#summary-25047879854

[bluetech]

LGTM. I tested that I can verify the files, and also that if I corrupt one of the files it doesn't verify.

Maybe add a release note telling people that we're now doing that? (Perhaps call it "experimental")

Note: even though it is technically necessary only for the deploy workflow, as the test workflow does not publish its packages, decided to always attest the provenance in both cases to avoid any surprises related to this (say a misconfiguration) when deploying.

I think maybe we shouldn't create "useless" attestations like these:

• It feels to me like something that should only be done for files that are truly intended to be distributed, this way we have the property "distributed <=> signed" rather than just "distributed => signed" which seems vaguely useful.
• Each attestation like this will basically be stored in several immutable stores forever and it seems maybe not so nice to do it for every random workflow run...
• The commit in the attestation seems to lead nowhere, I guess it's because it's a PR?

[nicoddemus]

The commit in the attestation seems to lead nowhere, I guess it's because it's a PR?

Hmm that's strange, perhaps that's the merge commit? 🤔

EDIT:

Yep, that's 3fd5b86 from this branch merged with fdf3aa3 (main when that executed).

For our actual releases this should not be a problem, as they are triggered directly from the branch, not from a PR.

[nicoddemus]

Maybe add a release note telling people that we're now doing that? (Perhaps call it "experimental")

Done, wording suggestions are welcome.

It feels to me like something that should only be done for files that are truly intended to be distributed, this way we have the property "distributed <=> signed" rather than just "distributed => signed" which seems vaguely useful.

Each attestation like this will basically be stored in several immutable stores forever and it seems maybe not so nice to do it for every random workflow run...

Good points, undid it for test.yml.