为项目添加 github 的 Provenance 机制 (#6633)

* ci: add github provenance attestations

* ci: disable updater metadata in dev workflow

* ci: add provenance smoke test workflow

* build: fallback to alpha release assets api

* ci: remove signing env from dev workflow

* ci: disable updater artifacts in linux dev validation

* ci: support alpha manual trigger tag input

* ci: remove provenance validation scaffolding

* ci: drop redundant provenance job permissions

* ci: limit provenance to release workflow

.github/workflows/release.yml

@@ -240,6 +240,26 @@ jobs:
           args: --target ${{ matrix.target }}
           includeUpdaterJson: true
 
+      - name: Attest Windows bundles
+        if: matrix.os == 'windows-latest'
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: target/${{ matrix.target }}/release/bundle/nsis/*setup*
+
+      - name: Attest macOS bundles
+        if: matrix.os == 'macos-latest'
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: target/${{ matrix.target }}/release/bundle/dmg/*.dmg
+
+      - name: Attest Linux bundles
+        if: matrix.os == 'ubuntu-22.04'
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: |
+            target/${{ matrix.target }}/release/bundle/deb/*.deb
+            target/${{ matrix.target }}/release/bundle/rpm/*.rpm
+
   release-for-linux-arm:
     name: Release Build for Linux ARM
     needs: [check_tag_version]
@@ -367,6 +387,13 @@ jobs:
           echo "VERSION=$(cat package.json | jq '.version' | tr -d '"')" >> $GITHUB_ENV
           echo "BUILDTIME=$(TZ=Asia/Shanghai date)" >> $GITHUB_ENV
 
+      - name: Attest Linux bundles
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: |
+            target/${{ matrix.target }}/release/bundle/deb/*.deb
+            target/${{ matrix.target }}/release/bundle/rpm/*.rpm
+
       - name: Upload Release
         uses: softprops/action-gh-release@v2
         with:
@@ -478,6 +505,11 @@ jobs:
             Rename-Item $file.FullName $newName
           }
 
+      - name: Attest Windows bundles
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: target/${{ matrix.target }}/release/bundle/nsis/*setup*
+
       - name: Upload Release
         uses: softprops/action-gh-release@v2
         with: