ci(windows build): Generate GitHub Actions build provenance

fix warnings
step-security/harden-runner does not (yet) run on windows, so do not use it

Author: amilcarlucas

.github/workflows/windows_build.yml

@@ -24,14 +24,13 @@ jobs:
 
     permissions:
       contents: write
-      id-token: write  # Needed for keyless signing
-      actions: read    # Needed for provenance generation
+      id-token: write    # Needed for keyless signing
+      actions: read      # Needed for provenance generation
+      packages: write    # Add this permission for attestations
+      attestations: write # Add permissions for attestations
 
     steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@v2
-        with:
-          egress-policy: audit
+      # step-security/harden-runner does not (yet) run on windows, so do not use it
 
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -82,6 +81,21 @@ jobs:
           }
           Get-Content -Raw git_hash.txt
 
+      - name: Debug GitHub token and permissions
+        run: |
+          Write-Host "Checking GitHub token and permissions"
+          # Don't print the actual token, just check if it exists
+          if ([string]::IsNullOrEmpty("${{ secrets.GITHUB_TOKEN }}")) {
+            Write-Host "::warning::GITHUB_TOKEN is empty or not accessible"
+          } else {
+            Write-Host "GITHUB_TOKEN is available"
+          }
+
+          # Check if running in fork (which may have limited permissions)
+          if ("${{ github.repository }}" -ne "${{ github.repository_owner }}/${{ github.event.repository.name }}") {
+            Write-Host "::warning::Running in a fork which may have limited permissions"
+          }
+
       - name: Build installer
         run: |
           cd windows
@@ -90,6 +104,16 @@ jobs:
           ISCC.exe /dMyAppVersion=$env:VERSION ardupilot_methodic_configurator.iss
           ls Output
 
+      - name: Generate GitHub Actions build provenance
+        uses: actions/[email protected]
+        with:
+          subject-path: windows/Output/*.exe
+          subject-name: 'ardupilot_methodic_configurator'
+          push-to-registry: false
+          # Use the built-in token instead of secrets
+          github-token: ${{ github.token }}
+          show-summary: true
+
       - name: Install Cosign
         uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb
 
@@ -103,20 +127,29 @@ jobs:
             $encoded = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("$($hash)  $_"))
             $encoded
           }
-          echo "hashes=$(($hashes -join ','))" >> $env:GITHUB_OUTPUT
+          $hashesJoined = $hashes -join ','
+          "hashes=$hashesJoined" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
 
       - name: Store Executable Path
         id: exe_path
         run: |
           cd windows/Output
           $exePath = Get-ChildItem -Filter *.exe | Select-Object -First 1 -ExpandProperty FullName
-          echo "exe_path=$exePath" >> $env:GITHUB_OUTPUT
+          "exe_path=$exePath" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
 
       - name: Install SLSA Verifier
         run: |
-          $version = "v2.5.1"
+          $version = "v2.7.0"
           $url = "https://github.com/slsa-framework/slsa-verifier/releases/download/$version/slsa-verifier-windows-amd64.exe"
-          Invoke-WebRequest -Uri $url -OutFile slsa-verifier.exe
+          Invoke-WebRequest -Uri $url -OutFile "slsa-verifier.exe"
+
+          # Verify the download was successful
+          if (Test-Path "slsa-verifier.exe") {
+            Write-Host "SLSA verifier downloaded successfully to $(Get-Location)\slsa-verifier.exe"
+          } else {
+            Write-Host "::error::Failed to download SLSA verifier"
+            exit 1
+          }
 
       - name: Generate SLSA provenance
         uses: slsa-framework/slsa-github-generator/actions/generator/generic/create-base64-subjects-from-file@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0