try attest-build-provenance

Author: vszakats

.github/workflows/build.yml

@@ -582,6 +582,9 @@ jobs:
   win-gcc:
     runs-on: 'ubuntu-latest'
     timeout-minutes: 30
+    permissions:
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
@@ -607,6 +610,12 @@ jobs:
 
       - name: 'list dependencies'
         run: cat urls.txt *-version-*.txt || true
+      - uses: actions/attest-build-provenance@2
+        with:
+          subject-path: |
+            *-*-mingw*.*
+            urls.txt
+
       - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4
         with:
           name: 'curl-windows-gcc-noarm64'