[DylanRussell]

Description

Applies the release attestation and workflow hardening changes from open-telemetry/opentelemetry-python#5882 and open-telemetry/opentelemetry-python#5884:

• Adds GitHub SLSA build provenance attestation (actions/attest) to release.yml and package-release.yml, pins release checkouts to ref: ${{ github.sha }}, and updates gh release create to target the exact built commit SHA ($(git rev-parse HEAD)) and attach dist/*.
• Documents verifying release artifacts with gh attestation verify in RELEASING.md.
• Updates scripts/build.sh and scripts/build_a_package.sh to verify a clean git working tree before building, build with uv build (UV_EXCLUDE_NEWER=3d), and audit built wheel contents.
• Sets persist-credentials: false on remaining actions/checkout steps in release/backport workflows and authenticates pushes via gh auth setup-git.

Verified by running release.yml, package-release.yml (with PyPI upload disabled), and zizmor.yml on my fork (Release run, Package Release run, Zizmor run) and confirming gh attestation verify succeeds against the built artifacts.

Type of change

• New feature (non-breaking change which adds functionality)
• This change requires a documentation update

Checklist:

See contributing.md for styleguide, changelog guidelines, and more.

• I am a human and not a bot
• I have run tox -e precommit
• I have run tox -e typecheck
• I have run the relevant tests and linting tox environments

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on the author · refreshed 2026-11-11 15:09 UTC

Investigate required status check failures.

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Should this be with reviewers? Comment /dashboard route:reviewers to route it to them.
• Anything wrong — including the routing? Report it with what you expected; it helps us improve the dashboard.