chore: add attest to ci workflow (#29)

.github/workflows/ci.yaml

@@ -77,6 +77,21 @@ jobs:
           version: "latest"
           github_token: ${{ github.token }}
 
+  attest:
+    name: attest
+    runs-on: ubuntu-latest
+    needs: [tfsec]
+    permissions:
+      attestations: write
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - uses: actions/attest-build-provenance@v1
+        with:
+          subject-path: '*.tf'
+
   caller-identity-check:
     if: contains(github.event_name, 'pull_request')
     name: Return the IAM user
@@ -98,7 +113,7 @@ jobs:
   auto-approve:
     if: contains(github.event_name, 'pull_request')
     runs-on: ubuntu-latest
-    needs: [validate, tfsec, caller-identity-check]
+    needs: [validate, tfsec, attest, caller-identity-check]
     steps:
     - name: Auto Approve PR
       uses: actions/github-script@v7