actions: sign and attest artifacts

.github/workflows/build.yml

@@ -1,5 +1,10 @@
 name: Build and test GYB
 
+permissions:
+  id-token: write
+  attestations: write
+  contents: read
+
 on:
   push:
   pull_request:
@@ -483,6 +488,14 @@ jobs:
             gyb*.zip
             gyb*.msi
 
+      - name: Attest Build Provenance
+        uses: actions/attest-build-provenance@v1
+        with:
+        subject-path: |
+            gyb*.tar.xz
+            gyb*.zip
+            gyb*.msi
+
       - name: Tar Cache archive
         if: matrix.goal == 'build' && steps.cache-python-ssl.outputs.cache-hit != 'true'
         working-directory: ${{ github.workspace }}