test: updated copy-assets action

.github/workflows/copy-release-assets.yml

@@ -4,28 +4,38 @@ on:
   release:
     types: published
 
-permissions:
-  contents: write
-
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
   release:
     name: Copy assets to the new release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to upload assets to releases
+      attestations: write # to upload assets attestation for build provenance
+      id-token: write # grant additional permission to attestation action to mint the OIDC token permission
 
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Download and upload
+      - name: Download assets
         run: |
           LATEST="$(git describe --tags --abbrev=0)"
           PREVIOUS="$(git describe --tags --abbrev=0 "$LATEST"^)"
 
           mkdir release-assets && cd release-assets
 
           gh release download "$PREVIOUS"
-          gh release upload "$LATEST" -- *
+      
+      - name: Attest copied assets
+        working-directory: release-assets
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: *.zip, *.pdf, index.json, tldr.sha256sums
+
+      - name: Upload assets
+        working-directory: release-assets
+        run: gh release upload "$LATEST" -- *