ci: temporary signing probe

Author: AlexeyShalaev

.github/workflows/sign-probe.yml

@@ -0,0 +1,38 @@
+name: Sign probe (temporary, #24)
+
+on: pull_request
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  sign:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v7
+      - name: Render
+        run: |
+          uvx --with jinja2-time copier copy --defaults --trust --vcs-ref HEAD \
+            --data project_name=demo-lib --data project_description="Demo" \
+            --data author_name="Bedrock Python" --data author_email="maintainers@example.com" \
+            . "${RUNNER_TEMP}/demo-lib"
+      - name: Build, then the generated sign step exactly as rendered
+        working-directory: ${{ runner.temp }}/demo-lib
+        run: |
+          uv build
+          SIGN=$(uv run --no-project --with pyyaml python -c '
+          import yaml
+          steps = yaml.safe_load(open(".github/workflows/publish.yml"))["jobs"]["publish"]["steps"]
+          print(next(s["run"] for s in steps if "pypi-attestations" in s.get("run", "")))')
+          echo "$SIGN"
+          eval "$SIGN"
+          ls -la dist
+      - name: Verify against this workflow's identity
+        working-directory: ${{ runner.temp }}/demo-lib
+        run: |
+          uvx pypi-attestations verify attestation \
+            --identity "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/sign-probe.yml@${GITHUB_REF}" \
+            dist/*.whl dist/*.tar.gz
+          uvx pypi-attestations inspect dist/*.whl.publish.attestation | head -20