Attest build provenance (#431)

This uses the new build provenance support added in https://github.com/hynek/build-and-inspect-python-package/blob/main/CHANGELOG.md#250---2024-05-13.

.github/workflows/deploy.yml

@@ -12,6 +12,10 @@ jobs:
 
   package:
     runs-on: ubuntu-latest
+    # Required by attest-build-provenance-github.
+    permissions:
+      id-token: write
+      attestations: write
     env:
       SETUPTOOLS_SCM_PRETEND_VERSION: ${{ github.event.inputs.version }}
 
@@ -20,6 +24,9 @@ jobs:
 
     - name: Build and Check Package
       uses: hynek/[email protected]
+      with:
+        attest-build-provenance-github: 'true'
+
 
   deploy:
     needs: package
@@ -33,7 +40,7 @@ jobs:
     - uses: actions/checkout@v3
 
     - name: Download Package
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: Packages
         path: dist

.github/workflows/test.yml

@@ -17,10 +17,15 @@ jobs:
 
   package:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@v3
       - name: Build and Check Package
-        uses: hynek/[email protected]
+        uses: hynek/[email protected]
+        with:
+          attest-build-provenance-github: 'true'
 
   test:
 
@@ -49,7 +54,7 @@ jobs:
     - uses: actions/checkout@v3
 
     - name: Download Package
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: Packages
         path: dist