Add release signing and lockfile checks

[jacksonpradolima]

Summary

• add a uv lock freshness check to the code quality workflow
• extend the publish workflow to generate a CycloneDX SBOM, sign distributions with Sigstore, and upload the new assets to releases
• document the release assets and how to verify signatures

Testing

• not run (not requested)

---

Codex Task

[Copilot]

Pull request overview

This PR enhances the release process with supply chain security features and adds lockfile validation to the CI pipeline. It introduces Sigstore-based signing for release artifacts, SBOM generation for dependency tracking, and automated upload of these assets to GitHub releases. Additionally, it adds a lockfile freshness check to ensure the uv.lock file stays in sync with dependencies.

Key Changes:

• Added lockfile freshness validation to the code quality workflow
• Extended publish workflow with SBOM generation (CycloneDX format) and Sigstore signing
• Automated upload of wheels, source distributions, signatures, certificates, and SBOM to GitHub releases
• Documented the new release assets and signature verification process in README

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
.github/workflows/code_quality.yml	Adds uv lock --check step to verify lockfile is up-to-date with pyproject.toml
.github/workflows/publish.yml	Extends workflow with Syft SBOM generation, Sigstore signing, and automated release asset uploads; adds contents: write permission
README.md	Documents release assets (SBOM, signatures, certificates) and provides verification instructions using Sigstore CLI

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

@jacksonpradolima I've opened a new pull request, #150, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

@jacksonpradolima I've opened a new pull request, #151, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

@jacksonpradolima I've opened a new pull request, #152, to work on those changes. Once the pull request is ready, I'll request review from you.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud