ci(release): attest GitHub Release assets with build provenance (#7467)

Adds a build provenance attestation for every GitHub Release asset,
created in the `publish` job right before the release is made immutable.

- `actions/attest` signs the versioned tarballs, zips, deb/rpm/apk
packages, `checksums.txt` and the `install` script. The unversioned
`supabase_<os>_<arch>.tar.gz` aliases are byte-identical copies, so the
same attestations cover them by digest.
- `attestations: write` is granted to the `publish` job and to both
callers of `release-shared.yml` (`release.yml` and
`release-smoke-test.yml`), since a reusable workflow cannot exceed its
caller's permissions.

Anyone can now verify a downloaded asset with `gh attestation verify
<file> --repo supabase/cli`. Once a release ships with attestations, the
aqua registry entry for `supabase/cli` can add
`github_artifact_attestations` with `signer_workflow:
supabase/cli/.github/workflows/release-shared.yml`, which makes mise and
aqua verify each download against it.

This touches release infrastructure, so it needs a cherry-pick to
`v2.x`.

Author: jgoux

.github/workflows/release-shared.yml

@@ -283,6 +283,7 @@ jobs:
       LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY: ${{ secrets.LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY }}
       LINEAR_CLI_BETA_RELEASE_ACCESS_KEY: ${{ secrets.LINEAR_CLI_BETA_RELEASE_ACCESS_KEY }}
     permissions:
+      attestations: write
       contents: write
       id-token: write
     steps:
@@ -409,6 +410,16 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: bun apps/cli/scripts/upload-release-assets.ts verify --version "${VERSION}"
 
+      # Lets installers such as aqua and mise verify each asset with `gh attestation verify`; the
+      # unversioned tarball aliases share their versioned twin's digest, so they are covered too.
+      - name: Attest release assets
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
+        with:
+          subject-path: |
+            dist/supabase_${{ inputs.version }}_*
+            dist/checksums.txt
+            install
+
       - name: Publish GitHub Release (immutable)
         env:
           GH_TOKEN: ${{ github.token }}

.github/workflows/release-smoke-test.yml

@@ -35,6 +35,7 @@ jobs:
     # dry_run here, but GitHub validates nested-workflow permissions at startup.
     permissions:
       actions: read
+      attestations: write
       contents: write
       id-token: write
       pull-requests: write

.github/workflows/release.yml

@@ -341,6 +341,7 @@ jobs:
     # those granted to the calling job, so this must be declared here too.
     permissions:
       actions: read
+      attestations: write
       contents: write
       id-token: write
       pull-requests: write