build: use sigstore plugin for attestations

Author: ObserverOfTime

.github/workflows/deploy.yml

@@ -10,6 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
     environment:
       name: maven-central
       url: https://central.sonatype.com/artifact/io.github.tree-sitter/jtreesitter

pom.xml

@@ -47,6 +47,7 @@
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
     <maven.deploy.skip>true</maven.deploy.skip>
     <gpg.skip>true</gpg.skip>
+    <sigstore.skip>true</sigstore.skip>
     <jextract.skip>false</jextract.skip>
     <publish.auto>false</publish.auto>
     <publish.skip>true</publish.skip>
@@ -258,6 +259,19 @@
           </execution>
         </executions>
       </plugin>
+      <plugin>
+        <groupId>dev.sigstore</groupId>
+        <artifactId>sigstore-maven-plugin</artifactId>
+        <version>1.3.0</version>
+        <executions>
+          <execution>
+            <phase>verify</phase>
+            <goals>
+              <goal>sign</goal>
+            </goals>
+          </execution>
+        </executions>
+      </plugin>
       <plugin>
         <artifactId>maven-gpg-plugin</artifactId>
         <version>3.2.8</version>
@@ -312,6 +326,7 @@
       </activation>
       <properties>
         <gpg.skip>false</gpg.skip>
+        <sigstore.skip>false</sigstore.skip>
         <publish.auto>true</publish.auto>
         <publish.skip>false</publish.skip>
       </properties>