Attest build provenance for release binaries

.github/workflows/release.yml

@@ -21,6 +21,9 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     steps:
       - uses: actions/checkout@v5
 
@@ -31,6 +34,11 @@ jobs:
       - name: Build all platforms
         run: go run ./scripts/build -version "$GITHUB_REF_NAME"
 
+      - name: Attest build provenance
+        uses: actions/attest@v4
+        with:
+          subject-path: dist/remote-explorer-*
+
       - name: Write release notes
         env:
           TAG: ${{ github.ref_name }}
@@ -61,6 +69,12 @@ jobs:
           sha256sum --ignore-missing -c SHA256SUMS
           \`\`\`
 
+          Verify that a binary was built by this repository's release workflow:
+
+          \`\`\`bash
+          gh attestation verify remote-explorer-linux-amd64 --repo $REPO
+          \`\`\`
+
           EOF
 
       - name: Publish release