feat: Add workflow to release source tarball with vendored deps

.github/workflows/vendored-release.yml

@@ -0,0 +1,41 @@
+name: Vendored Source tarball
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # to upload assets to releases
+      attestations: write # to upload assets attestation for build provenance
+      id-token: write # grant additional permission to attestation action to mint the OIDC token permission
+
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: 1.22
+
+    - name: Vendor dependencies
+      run: |
+        go get
+        go mod vendor
+        tar cvf vib-vendored-deps.tar.xz *
+
+    - name: Upload a Release Asset
+      if: github.repository == 'Vanilla-OS/Vib'
+      uses: softprops/action-gh-release@v2
+      with:
+        files: vib-vendored-deps.tar.xz
+
+    - name: Attest generated files
+      if: github.repository == 'Vanilla-OS/Vib'
+      id: attest
+      uses: actions/attest-build-provenance@v1
+      with:
+        subject-path: 'vib-vendored-deps.tar.xz'