Add SLSA build provenance attestations to release workflows (#7097)

.github/workflows/release.yml

@@ -13,6 +13,7 @@ permissions:
   id-token: write   # Required for AWS OIDC authentication in called workflow
   contents: write   # Required for creating releases and by actions/checkout
   actions: read     # May be needed for some workflows
+  attestations: write  # Required for SLSA build provenance attestations
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -92,12 +93,26 @@ jobs:
     needs: [build-cli, install-script, bundle-desktop, bundle-desktop-intel, bundle-desktop-linux, bundle-desktop-windows]
     permissions:
       contents: write
+      id-token: write      # Required for Sigstore OIDC signing
+      attestations: write  # Required for SLSA build provenance attestations
     steps:
       - name: Download all artifacts
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
         with:
           merge-multiple: true
 
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f  # v3.2.0
+        with:
+          subject-path: |
+            goose-*.tar.bz2
+            goose-*.zip
+            Goose*.zip
+            *.deb
+            *.rpm
+            *.flatpak
+            download_cli.sh
+
       # Create/update the versioned release
       - name: Release versioned
         uses: ncipollo/release-action@b7eabc95ff50cbeeedec83973935c8f306dfcd0b  # v1.20.0