Could you add artifact attestations?

[NeilJed]

We currently use Terragrunt as part of a custom CICD pipeline where we can't install from any public repo. Currently we opt to install it directly from GitHub from the current releases rather than build from source.

We try to be as secure as possibly with our CICD toolchain and was wondering if you could consider adding artifact attestation to the release binaries? TFLint currently does this and it helps us stay compliant as we can verify who and what built the binary.

Given the wide spread use of Terragrunt and the industries move towards SDLC and verification at least for us it would give us a lot more confidence when installing it rather than just checking it against the checksum.