gh attestation verify doesn't actually inspect provenance statement generated by this action

[arianvp]

In order to be SLSA-compliant; the SLSA provenance predicate should be verified as instructed in https://slsa.dev/spec/v1.0/verifying-artifacts however the CLI doesn't do that. I found this surprising.

The contents of the provenance statement should matched against the content of the signing certificate otherwise there is very little point in creating the statement with https://github.com/actions/attest-build-provenance in the first place.

I expected the cli to inspect the contents of the predicate and inspect the contents of the statement; check that buildType is https://actions.github.io/buildtypes/workflow/v1 and match inspect externalParameters and verify them against the contents of the sigstore certificate. But this doesn't seem to be happening.

Not sure if this bug should be tracked here or in https://github.com/cli/cli