ci(release): Rework python package build/publish steps #442

gfieni · 2024-10-15T11:51:59Z

PR overview:

Separate the Python package build and publish steps into two jobs ;
Build PowerAPI wheel and sdist using uv ;
Upload generated wheel and sdist as GitHub Actions artifacts ;
Add generation of SLSA provenance attestation for the build artifacts ;
Upload wheel, sdist and SLSA provenance attestation to the GitHub release assets.

Separate the python package build and publish steps in order to secure against arbitrary code that could be executed by a build dependency. Thanks to this, we can now generate SLSA provenance attestations for the generated build artifacts and upload them as release assets.