ci: align deploy workflow with inspect-cert-chain

Author: robjtede

.github/workflows/deploy.yml

@@ -6,6 +6,8 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
 
 env:
   CARGO_INCREMENTAL: 0
@@ -30,10 +32,10 @@ jobs:
           - { os: macos-latest, target: x86_64-apple-darwin }
           - { os: ubuntu-latest, target: aarch64-unknown-linux-gnu }
           - { os: ubuntu-latest, target: aarch64-unknown-linux-musl }
-          - { os: ubuntu-latest, target: x86_64-unknown-freebsd }
+          # - { os: ubuntu-latest, target: x86_64-unknown-freebsd }
           - { os: ubuntu-latest, target: x86_64-unknown-linux-gnu }
           - { os: ubuntu-latest, target: x86_64-unknown-linux-musl }
-          - { os: windows-latest, target: aarch64-pc-windows-msvc }
+          # - { os: windows-latest, target: aarch64-pc-windows-msvc }
           - { os: windows-latest, target: x86_64-pc-windows-msvc }
 
     name: Deploy (${{ matrix.target }})
@@ -42,41 +44,35 @@ jobs:
     timeout-minutes: 60
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@v6
+
+      - name: Install nasm
+        if: matrix.os == 'windows-latest'
+        uses: ilammy/setup-nasm@v1.5.2
 
       - name: Install Rust
-        uses: actions-rust-lang/setup-rust-toolchain@a0b538fa0b742a6aa35d6e2c169b4bd06d225a98 # v1.15.3
+        uses: actions-rust-lang/setup-rust-toolchain@v1.15.3
         with:
           cache: false
 
-      # TODO: see if this is needed after next deploy
-      # - if: startsWith(matrix.os, 'ubuntu') && !endsWith(matrix.target, '-musl')
-      - uses: taiki-e/setup-cross-toolchain-action@b8d1a322a6009a2b7220f53996695778eef89b41 # v1.38.0
+      - uses: taiki-e/setup-cross-toolchain-action@v1.38.0
         with:
           target: ${{ matrix.target }}
 
-      # TODO: see if this is needed after next deploy
-      # - if: endsWith(matrix.target, '-musl')
-      #   uses: taiki-e/install-action@v2.23.1
-      #   with:
-      #     tool: cross
-
       # TODO: see if this is needed after next deploy
       # - if: endsWith(matrix.target, 'windows-msvc')
       #   run: echo "RUSTFLAGS=${RUSTFLAGS} -C target-feature=+crt-static" >> "${GITHUB_ENV}"
 
       - name: Build and upload to release
         id: upload-release
-        uses: taiki-e/upload-rust-binary-action@f391289bcff6a7f36b6301c0a74199657bbb4561 # v1.28.0
+        uses: taiki-e/upload-rust-binary-action@v1.27.0
         with:
           bin: protobug
           target: ${{ matrix.target }}
-          tar: all
-          zip: all
-          checksum: sha256,sha512
+          checksum: sha256
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Generate artifact attestation
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        uses: actions/attest-build-provenance@v4
         with:
-          subject-path: ${{ steps.upload-release.outputs.zip }}
+          subject-path: "${{ steps.upload-release.outputs.archive }}.*"