[8.2.x] Attest package provenance (#12335)

Co-authored-by: Bruno Oliveira <nicoddemus@gmail.com>

Author: github-actions[bot]

.github/workflows/deploy.yml

@@ -19,14 +19,21 @@ jobs:
  SETUPTOOLS_SCM_PRETEND_VERSION: ${{ github.event.inputs.version }}
  timeout-minutes: 10
 
+ # Required by attest-build-provenance-github.
+ permissions:
+ id-token: write
+ attestations: write
+
  steps:
  - uses: actions/checkout@v4
  with:
  fetch-depth: 0
  persist-credentials: false
 
  - name: Build and Check Package
- uses: hynek/build-and-inspect-python-package@v2.4.0
+ uses: hynek/build-and-inspect-python-package@v2.5.0
+ with:
+ attest-build-provenance-github: 'true'
 
  deploy:
  if: github.repository == 'pytest-dev/pytest'

.github/workflows/test.yml

@@ -35,7 +35,7 @@ jobs:
  fetch-depth: 0
  persist-credentials: false
  - name: Build and Check Package
- uses: hynek/build-and-inspect-python-package@v2.4.0
+ uses: hynek/build-and-inspect-python-package@v2.5.0
 
  build:
  needs: [package]

changelog/12333.trivial.rst

@@ -0,0 +1 @@
+pytest releases are now attested using the recent `Artifact Attestation <https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/>` support from GitHub, allowing users to verify the provenance of pytest's sdist and wheel artifacts.