fix: openssf signed release score improvement

Signed-off-by: degenaro <lou.degenaro@gmail.com>

Author: degenaro

.github/workflows/python-push.yml

@@ -280,6 +280,7 @@ jobs:
     # --- Generate provenance for the ACTUAL RELEASE ARTIFACTS ---
 
     - name: Generate SLSA build provenance
+      id: attest
       if: steps.release.outputs.released == 'true'
       uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
       with:
@@ -297,6 +298,13 @@ jobs:
       with:
         inputs: "dist/*"
 
+    # Copy the SLSA provenance bundle into dist/ AFTER PyPI publish (PyPI must not
+    # receive it) so that upload-to-gh-release attaches it to the GitHub Release.
+    # Scorecard's releasesHaveProvenance probe requires a *.intoto.jsonl asset.
+    - name: Stage provenance bundle for GitHub Release
+      if: steps.release.outputs.released == 'true'
+      run: cp "${{ steps.attest.outputs.bundle-path }}" dist/attestation.intoto.jsonl
+
     - name: Publish package distributions to GitHub Releases
       uses: python-semantic-release/upload-to-gh-release@0a92b5d7ebfc15a84f9801ebd1bf706343d43711 # v9.8.9
       if: steps.release.outputs.released == 'true'