Replace manual sigstore installation with gh-action-sigstore-python

[Copilot]

Migrates the publish workflow from manual sigstore CLI installation to the official GitHub Action.

Changes:

• Removed manual pip install sigstore==4.1.0 step
• Removed manual sigstore sign command execution
• Added sigstore/[email protected] action with equivalent inputs

Before:

- name: Install sigstore
  run: python -m pip install sigstore==4.1.0

- name: Sign distributions
  run: |
    cd dist
    sigstore sign *.whl *.tar.gz

After:

- name: Sign distributions with Sigstore
  uses: sigstore/[email protected]
  with:
    inputs: >-
      dist/*.whl
      dist/*.tar.gz

Artifact outputs (.sig, .pem files) remain unchanged.

Original prompt

replace in https://github.com/jacksonpradolima/gsp-py/blob/master/.github/workflows/publish.yml to use https://github.com/marketplace/actions/gh-action-sigstore-python

full docs: https://sigstore.github.io/sigstore-python/

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR modernizes the package signing process by replacing manual sigstore CLI installation and invocation with the official sigstore/gh-action-sigstore-python GitHub Action. The change simplifies the workflow while maintaining identical artifact outputs.

Key Changes:

• Replaced manual pip install sigstore==4.1.0 and CLI command with the official GitHub Action
• Consolidated two workflow steps into a single action invocation
• Maintained compatibility with existing release asset structure (.sig and .pem files)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.