publish to sigstore transparency log only on final prod step

Author: qrkourier

.github/workflows/wheels.yml

@@ -81,10 +81,12 @@ jobs:
           packages-dir: dist
           skip-existing: true
           verbose: true
+          attestations: false
 
       - name: Publish wheels (PyPI)
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: dist
           verbose: true
+          attestations: true