Collect and upload PEP 740 attestations during uv publish (#16731)

Co-authored-by: konsti <konstin@mailbox.org>

docs/reference/cli.md

@@ -5833,7 +5833,7 @@ uv publish [OPTIONS] [FILES]...
 <h3 class="cli-reference">Arguments</h3>
 
 <dl class="cli-reference"><dt id="uv-publish--files"><a href="#uv-publish--files"<code>FILES</code></a></dt><dd><p>Paths to the files to upload. Accepts glob expressions.</p>
-<p>Defaults to the <code>dist</code> directory. Selects only wheels and source distributions, while ignoring other files.</p>
+<p>Defaults to the <code>dist</code> directory. Selects only wheels and source distributions and their attestations, while ignoring other files.</p>
 </dd></dl>
 
 <h3 class="cli-reference">Options</h3>
@@ -5889,7 +5889,9 @@ uv publish --publish-url https://upload.pypi.org/legacy/ --check-url https://pyp
 <p>May also be set with the <code>UV_MANAGED_PYTHON</code> environment variable.</p></dd><dt id="uv-publish--native-tls"><a href="#uv-publish--native-tls"><code>--native-tls</code></a></dt><dd><p>Whether to load TLS certificates from the platform's native certificate store.</p>
 <p>By default, uv loads certificates from the bundled <code>webpki-roots</code> crate. The <code>webpki-roots</code> are a reliable set of trust roots from Mozilla, and including them in uv improves portability and performance (especially on macOS).</p>
 <p>However, in some cases, you may want to use the platform's native certificate store, especially if you're relying on a corporate trust root (e.g., for a mandatory proxy) that's included in your system's certificate store.</p>
-<p>May also be set with the <code>UV_NATIVE_TLS</code> environment variable.</p></dd><dt id="uv-publish--no-cache"><a href="#uv-publish--no-cache"><code>--no-cache</code></a>, <code>--no-cache-dir</code>, <code>-n</code></dt><dd><p>Avoid reading from or writing to the cache, instead using a temporary directory for the duration of the operation</p>
+<p>May also be set with the <code>UV_NATIVE_TLS</code> environment variable.</p></dd><dt id="uv-publish--no-attestations"><a href="#uv-publish--no-attestations"><code>--no-attestations</code></a></dt><dd><p>Do not upload attestations for the published files.</p>
+<p>By default, uv attempts to upload matching PEP 740 attestations with each distribution that is published.</p>
+<p>May also be set with the <code>UV_PUBLISH_NO_ATTESTATIONS</code> environment variable.</p></dd><dt id="uv-publish--no-cache"><a href="#uv-publish--no-cache"><code>--no-cache</code></a>, <code>--no-cache-dir</code>, <code>-n</code></dt><dd><p>Avoid reading from or writing to the cache, instead using a temporary directory for the duration of the operation</p>
 <p>May also be set with the <code>UV_NO_CACHE</code> environment variable.</p></dd><dt id="uv-publish--no-config"><a href="#uv-publish--no-config"><code>--no-config</code></a></dt><dd><p>Avoid discovering configuration files (<code>pyproject.toml</code>, <code>uv.toml</code>).</p>
 <p>Normally, configuration files are discovered in the current directory, parent directories, or user configuration directories.</p>
 <p>May also be set with the <code>UV_NO_CONFIG</code> environment variable.</p></dd><dt id="uv-publish--no-managed-python"><a href="#uv-publish--no-managed-python"><code>--no-managed-python</code></a></dt><dd><p>Disable use of uv-managed Python versions.</p>

docs/reference/environment.md

@@ -466,6 +466,12 @@ Don't upload a file if it already exists on the index. The value is the URL of t
 Equivalent to the `--index` command-line argument in `uv publish`. If
 set, uv the index with this name in the configuration for publishing.
 
+### `UV_PUBLISH_NO_ATTESTATIONS`
+<small class="added-in">added in `next release`</small>
+
+Equivalent to the `--no-attestations` command-line argument in `uv publish`. If set,
+uv will skip uploading any collected attestations for the published distributions.
+
 ### `UV_PUBLISH_PASSWORD`
 <small class="added-in">added in `0.4.16`</small>