[FEAT]: Update workflows to use attestations when publishing to PyPI.

[nfelt14]

Description

Update workflows to use attestations when publishing to PyPI.

pypa/gh-action-pypi-publish#255

Additional Information

No response

[nfelt14]

relates to #41

[nfelt14]

Things to investigate, leaving here for future use:

• https://github.com/marketplace/actions/gh-action-sigstore-python
• https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
  • https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/#signing-the-distribution-packages
• Could also use this: Expose PEP 740 attestations functionality pypa/gh-action-pypi-publish#236
  • Then the build attestations from the current workflows could be removed

[nfelt14]

Another simple example of signing: executablebooks/mdformat-footnote@v0.1.1...v0.1.2

[nfelt14]

This may already be on by default, but currently it doesn't support reusable workflows