ci: add upload artifact, attest-build-provenance

Signed-off-by: Rafael Passos <rafael@rcpassos.me>

Author: auyer

.github/workflows/publish.yaml

@@ -75,6 +75,13 @@ jobs:
           zip protonup-rs-linux-amd64.zip protonup-rs
           tar -czvf protonup-rs-linux-amd64.tar.gz protonup-rs
 
+      - name: Upload packages as GH artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: packages
+          path: 'target/release/protonup-rs**.{gz,zip,rpm,deb}'
+          retention-days: 7
+
       - name: Upload Zipped,Tar gzed, DEB and RPM binaries to release
         uses: svenstaro/upload-release-action@04733e069f2d7f7f0b4aebc4fbdbce8613b03ccd #v2.9.0
         with:
@@ -126,6 +133,14 @@ jobs:
         run: |
           echo "hashes=$(sha256sum $(echo *.zip *.deb *.rpm *.gz ) | base64 -w0)" >> "$GITHUB_OUTPUT"
 
+      - uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
+        with:
+          subject-path: |
+            'target/release/protonup-rs*.gz
+            'target/release/protonup-rs*.zip
+            'target/release/protonup-rs*.rpm
+            'target/release/protonup-rs*.deb
+
   provenance:
     needs: [release]
     permissions: