[github] try out attest

.github/workflows/hugo.yml

@@ -8,11 +8,11 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
 permissions:
   contents: read
   pages: write
   id-token: write
+  attestations: write
 
 # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
 # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
@@ -59,6 +59,11 @@ jobs:
         with:
           path: ./public
 
+      - name: Attest
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: './public'
+
   deploy:
     environment:
       name: github-pages