chore: ITSEC-2207 Add SDK artifact SBOM signing (#2119)

Signed-off-by: immutable-art <[email protected]>

.github/workflows/publish.yaml

@@ -30,6 +30,9 @@ on:
     branches:
       - main
 
+permissions:
+  attestations: write # Required for GitHub Attestation
+
 env:
   RELEASE_TYPE: ${{ github.event.inputs.release_type || 'alpha' }}
   UPGRADE_TYPE: ${{ github.event.inputs.upgrade_type || 'none' }}
@@ -127,6 +130,11 @@ jobs:
           tag: ${{ contains(env.RELEASE_TYPE, 'alpha') && 'alpha' }}
           dry-run: ${{ env.DRY_RUN }}
 
+      - name: Generate SDK attestation
+        uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: './sdk'
+
       - name: Authenticate NPM
         if: contains(env.RELEASE_TYPE, 'release')
         run: npm config set //registry.npmjs.org/:_authToken ${{ secrets.TS_IMMUTABLE_SDK_NPM_TOKEN }}