Review the new GitHub attestations

[digiserg]

https://github.blog/2024-05-02-introducing-artifact-attestations-now-in-public-beta/

[digiserg]

[digiserg]

The attestations appear to work the Windows builds and I have disabled them again.

electron-userland/electron-builder#7248

[millerjp]

@digiserg whats the status of this - I am confused as to if this is done for 1.0?

[digiserg]

One of the requirements for the attestations to work is to change the pipeline permissions using:

permissions:
  id-token: write
  attestations: write

but this seems to be affecting electron-builder and it can't sign the builds. We'll leave this to the next release when I have more time to investigate it.