ci: add github attestation

Signed-off-by: Richard Zak <[email protected]>

.github/workflows/release.yml

@@ -7,7 +7,9 @@ on:
       - main
 
 permissions:
+  attestations: write
   contents: read
+  id-token: write
 
 jobs:
   linux:
@@ -298,3 +300,17 @@ jobs:
             sbom.json.minisig
             minisign.pub
       - run: echo 00000 > ~/.minisign/minisign.key
+
+      - uses: actions/attest-build-provenance@7668571508540a607bdfd90a87a560489fe372eb # v2.1.0
+        with:
+          subject-path: |
+            mdb_server_darwin_arm64
+            mdb_client_darwin_arm64
+            mdb_server_amd64.exe
+            mdb_server_arm64.exe
+            mdb_client_amd64.exe
+            mdb_client_arm64.exe
+            mdb_server_linux_musl_x86_64
+            mdb_client_linux_musl_x86_64
+            sbom.xml
+            sbom.json