Fix PyPI publish: exclude Sigstore .sigstore.json files from dist/

[Copilot]

PR #160 added attestations: false to prevent duplicate attestation creation, but deployments still failed. Sigstore v3 creates .sigstore.json files in dist/ that PyPI rejects (only accepts .whl/.tar.gz).

Changes

• Move attestations pre-publish: Extract .sigstore.json files from dist/ to attestations/ after signing, before PyPI upload
• Fix release asset patterns: Update from non-existent .sig/.pem to actual .sigstore.json files in new location

- name: Sign distributions with Sigstore
  uses: sigstore/gh-action-sigstore-python@v3.0.0
  with:
    inputs: >-
      dist/*.whl
      dist/*.tar.gz

- name: Move Sigstore attestations out of dist
  run: |
    mkdir -p attestations
    if ls dist/*.sigstore.json 1> /dev/null 2>&1; then
      mv dist/*.sigstore.json attestations/
    fi

- name: Upload release assets
  uses: softprops/action-gh-release@v2
  with:
    files: |
      dist/*.whl
      dist/*.tar.gz
      attestations/*.sigstore.json
      dist/sbom.json

Note: README verification examples still reference deprecated .sig/.pem format; update separately for Sigstore v3 bundle verification.

Original prompt

@copilot the PR #160 was merged and I tried to deploy to pypi but I still see the error: https://github.com/jacksonpradolima/gsp-py/actions/runs/20643314856/job/59277919996
Fix it in other PR

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR fixes the PyPI deployment failure that occurred after PR #160 was merged. The root cause was that Sigstore creates .sigstore.json attestation files in the dist/ directory, which PyPI rejects during upload. The fix moves these attestation files out of dist/ before the PyPI upload step while still including them in the GitHub release assets.

Key changes:

• Added a step to move .sigstore.json attestation files from dist/ to a separate attestations/ directory
• Updated release assets upload patterns to reference the new attestations/ directory instead of the old .sig and .pem file patterns

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.