[release] Support for GitHub Artifact Attestation

[brunoborges]

See the announcement.

More detailed information in GitHub's generate-build-provenance repository.

[aalmiray]

As far as I can tell the behavior is exposed as a GH action. JReleaser would require direct API calls while running on a GitHub runner. I suppose 3rd parties may not have access to such API otherwise bad actors may gain access.

@martinwoodward @brunoborges would appreciate any tips & hints you may provide 😅

[aalmiray]

Similarly as it was done with SLSA catalog, JReleaser can generate file that contains a list of all releasable artifacts that should be attestated. This file would have to be fed to the https://github.com/actions/attest-build-provenance action

In this way, there's no external duplication when defining subject paths and there should be a match with every artifact posted as a release asset.

cc: @sormuras

[sormuras]

Lovely!

Beware that there's another interesting feature on the roadmap:

• GitHub Release Attestations github/roadmap#943

Which could render the interaction with JReleaser as easy as:

• just release to GHA with JReleaser
• let the release process generated attestations for all attached artifacts

No?