ATTEST-BUILD-PROVENANCE

Summary from the TLDR InfoSec newsletter

The attest-build-provenance action generates signed build provenance attestations for workflow artifacts. These attestations associate an artifact with its digest to SLSA build provenance predicate in the in-toto format, accompanied by a verifiable signature from a short-lived Sigstore certificate. The attestation generation differs based on repository visibility: public repositories use the public Sigstore instance, while private repositories utilize GitHub's private Sigstore.