Add build provenance for gh CLI releases

[malancas]

Fixes #9041

This adds build provenance for gh CLI releases. Because gh CLI releases generate multiple artifacts, the Action will create an attestation for each artifact prefixed with gh found in the dist directory.

[williammartin]

Hihi, thanks for looking at this @malancas.

Is there a reason to do this in the job for each platform rather than once for all artifacts in the release job? We grab the artifacts upload from each platform job, and downloaded into the release job here:

cli/.github/workflows/deployment.yml

Line 277 in 1bc3cfa

mv -v {linux,macos,windows}/gh_* dist/

Job logs: https://github.com/cli/cli/actions/runs/9066936008/job/24911809571

---

Edit: in fact when I look at the issue this seems to be what andy proposed and you agreed upon which makes me even more curious!

[williammartin]

If we don't gate this via inputs.environment == 'production' we could also test that the signing works before we do a production release. Or do you feel confident enough in this to do it live?

For example:

cli/.github/workflows/deployment.yml

Line 330 in 1bc3cfa

DO_PUBLISH: ${{ inputs.environment == 'production' }}

[malancas]

If we don't gate this via inputs.environment == 'production' we could also test that the signing works before we do a production release. Or do you feel confident enough in this to do it live?

For example:

cli/.github/workflows/deployment.yml

Line 330 in 1bc3cfa

DO_PUBLISH: ${{ inputs.environment == 'production' }}

I feel confident enough to do it live but we can generate provenance for a non-production release if you'd like. Note that all attestations will be available for view on https://github.com/cli/cli/attestations. So if we do decide to generate non-production attestations, they will appear on that page alongside the production attestations.

[williammartin]

LGTM thank you. Looking forward to trying it out.