Merge pull request #90 from openziti/sigstore-only-on-final-publish

publish to sigstore transparency log only on final prod step

Author: ekoby

.github/workflows/mattermost-ziti-webhook.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     name: POST Webhook
     steps:
-    - uses: openziti/ziti-mattermost-action-py@main
+    - uses: openziti/ziti-mattermost-action-py@debug-py-action
       if: |
         github.repository_owner == 'openziti'
         && ((github.event_name != 'pull_request_review')

.github/workflows/wheels.yml

@@ -81,10 +81,12 @@ jobs:
           packages-dir: dist
           skip-existing: true
           verbose: true
+          attestations: false
 
       - name: Publish wheels (PyPI)
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
         uses: pypa/gh-action-pypi-publish@release/v1
         with:
           packages-dir: dist
           verbose: true
+          attestations: true