🔧 update cd.yml workflow (add riscv64, s390x and armv7l)

and restore unique attestation "multiple.intoto.jsonl"

Author: Ousret

.github/workflows/cd.yml

@@ -47,16 +47,39 @@ jobs:
     needs: pre_flight_check
     strategy:
       matrix:
-        os: [ ubuntu-latest, windows-latest, macos-14 ]
+        os: [ubuntu-latest, windows-latest, macos-14, ubuntu-24.04-arm]
         qemu: [ '' ]
+        musl: [ '' ]
         include:
           # Split ubuntu job for the sake of speed-up
           - os: ubuntu-latest
-            qemu: aarch64
+            qemu: ppc64le
+            musl: ""
           - os: ubuntu-latest
             qemu: ppc64le
+            musl: musllinux
+          - os: ubuntu-latest
+            qemu: riscv64
+            musl: ""
+          - os: ubuntu-latest
+            qemu: riscv64
+            musl: musllinux
           - os: ubuntu-latest
             qemu: s390x
+            musl: ""
+          - os: ubuntu-latest
+            qemu: s390x
+            musl: musllinux
+          - os: ubuntu-latest
+            qemu: armv7l
+            musl: ""
+          - os: ubuntu-latest
+            qemu: armv7l
+            musl: musllinux
+          - os: ubuntu-latest
+            musl: musllinux
+          - os: ubuntu-24.04-arm
+            musl: musllinux
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -86,13 +109,48 @@ jobs:
           CIBW_ENVIRONMENT: CHARSET_NORMALIZER_USE_MYPYC='1'
           CIBW_TEST_REQUIRES: pytest
           CIBW_TEST_COMMAND: pytest -c {package} {package}/tests
-          CIBW_SKIP: "cp31?t-*"
+          CIBW_SKIP: "cp31?t-* ${{ matrix.musl == 'musllinux' && '*manylinux*' || '*musllinux*' }}"
       - name: Upload artifacts
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: dist-${{ matrix.os }}-${{ matrix.qemu }}
           path: ./wheelhouse/*.whl
 
+  checksum:
+    name: Compute hashes
+    runs-on: ubuntu-latest
+    needs:
+      - build-wheels
+      - universal-wheel
+    outputs:
+      hashes: ${{ steps.compute.outputs.hashes }}
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Download distributions
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a
+        with:
+          name: dist
+          path: dist
+      - name: Collected dists
+        run: |
+          tree dist
+      - name: Generate hashes
+        id: compute  #  needs.checksum.outputs.hashes
+        working-directory: ./dist
+        run: echo "hashes=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
+
+  provenance:
+    needs: checksum
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
+    permissions:
+      actions: read
+      id-token: write
+      contents: write
+    with:
+      base64-subjects: ${{ needs.checksum.outputs.hashes }}
+      upload-assets: true
+      compile-generator: true
+
   deploy:
     name: 🚀 Deploy to PyPi
     runs-on: ubuntu-latest
@@ -101,8 +159,7 @@ jobs:
       id-token: write
       contents: write
     needs:
-      - build-wheels
-      - universal-wheel
+      - provenance
     environment:
       name: pypi
       url: https://pypi.org/project/charset-normalizer/