[ci] Add artifact attestation to build

Adds a signed build provenance attestations via https://github.com/actions/attest-build-provenance

Author: poteto

.github/workflows/runtime_build_and_test.yml

@@ -332,12 +332,37 @@ jobs:
       - name: Display structure of build
         run: ls -R build
       - name: Archive build
+        id: upload_build
         uses: actions/upload-artifact@v4
         with:
           name: _build_${{ matrix.worker_id }}_${{ matrix.release_channel }}
           path: build
           if-no-files-found: error
 
+  attest_build:
+    name: Generate signed build provenance attestations
+    runs-on: ubuntu-latest
+    needs: [build_and_lint]
+    permissions:
+      # Attestation for build: https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds#generating-build-provenance-for-binaries
+      id-token: write
+      contents: read
+      attestations: write
+    steps:
+      - name: Restore archived build
+        uses: actions/download-artifact@v4
+        with:
+          pattern: _build_*
+          path: build
+          merge-multiple: true
+      - name: Display structure of build
+        run: ls -R build
+      - name: Calculate build digest
+        run: find build -type f -print0 | LC_ALL=C sort -z | xargs -0 shasum -a 256 > subject.checksums.txt
+      - uses: actions/attest-build-provenance@v2
+        with:
+          subject-checksums: subject.checksums.txt
+
   test_build:
     name: yarn test-build
     needs: [build_and_lint, runtime_compiler_node_modules_cache]