Generate attestation for signed VbaCompression packages

Author: jozefizso

.github/workflows/release-signed.yml

@@ -65,6 +65,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
+      attestations: write
 
     steps:
     - name: publish artifact
@@ -94,6 +95,13 @@ jobs:
         --trusted-signing-account "OpenSourceSigning"
         --trusted-signing-certificate-profile "JozefIzsoOpenSourceProfile"
 
+    - name: attestation
+      uses: actions/attest@v2
+      with:
+        subject-path: 'dist/*.nupkg'
+        predicate-type: 'https://slsa.dev/provenance/v1'
+        predicate: '{}'
+
     - name: publish artifact
       uses: actions/upload-artifact@v4
       with: