wip: sign maven release artifacts with sigstore/cosign

.github/workflows/jreleaser.yml

@@ -6,6 +6,14 @@ on:
       release-script-to-run:
         required: true
         type: string
+      attest-artifacts:
+        required: false
+        type: boolean
+        default: true # calling workflows can opt-out of attestation
+
+permissions:
+  id-token: write # for verifying identity in attestation process
+  attestations: write # to push attestation
 
 jobs:
   jreleaser:
@@ -29,6 +37,12 @@ jobs:
           JRELEASER_NEXUS2_MAVEN_CENTRAL_USERNAME: ${{ secrets.JRELEASER_NEXUS2_MAVEN_CENTRAL_USERNAME }}
           JRELEASER_NEXUS2_MAVEN_CENTRAL_PASSWORD: ${{ secrets.JRELEASER_NEXUS2_MAVEN_CENTRAL_PASSWORD }}
 
+      - name: Sign artifacts with sigstore/cosign
+        if: inputs.attest-artifacts
+        uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v1.4.3
+        with:
+          subject-path: './target/staging-deploy/**/*.jar'
+
         # Log failures
       - name: JReleaser release output
         if: always()

.github/workflows/release-nightly.yml

@@ -3,10 +3,15 @@ name: Release nightly version
 on:
     schedule:
       - cron: '0 0 * * *' # Every day at 00:00 UTC (https://crontab.guru/#0_0_*_*_*)
+    # For testing also allow it now...
+    pull_request:
+      branches:
+        - master
 
 jobs:
   nightly:
     uses: ./.github/workflows/jreleaser.yml
     with:
       release-script-to-run: chore/release-nightly.sh
+      attest-artifacts: true
     secrets: inherit