chore: release with attestation (#23)

Signed-off-by: Mario Constanti <github@constanti.de>

.github/workflows/release.yaml

@@ -11,6 +11,7 @@ on:
 permissions:
   contents: write
   id-token: write
+  attestations: write
 
 jobs:
   goreleaser:
@@ -30,4 +31,17 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_TOKEN }}
 
       - name: Update new version in krew-index
-        uses: rajatjindal/krew-release-bot@v0.0.46
+        uses: rajatjindal/krew-release-bot@v0.0.46
+
+      # attest archives
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: "dist/*.tar.gz"
+
+      # attest SBOM
+      - name: Generate SBOM attestation
+        uses: actions/attest-sbom@v1
+        with:
+          subject-path: "dist/*.tar.gz"
+          sbom-path: "tmp/kubectl-dpm.bom.spdx"