feat(workflows): Reusable workflow to attest GitHub Releases

[javirln]

This creates a reusable workflow that automatically attest a GitHub release based on its content. It's possible to also pass additional materials to be added to the attestation. Additionally it will try to create a workflow if it does not exist.

By default it will attest:

• All assets within a GitHub Release
• The source code in a .tar.gz

Required parameters:

• API Token: Chainloop API token to perform the attestation
• Cosign key and password: To sign the final attestation
  Optional parameters:
• Workflow name: Name of the target workflow to be attested
• Project: Name of the project
• Additional materials: Comma separated list of values to be added to the attestation

Closes chainloop-dev/chainloop#844

[javirln]

Check if we can have set a constraint to only use this workflow on release events.

[javirln]

Example of input interpolation:
Give the following job:

name: Release

on:
  pull_request:

permissions:
  contents: read

jobs:
  testing-echo:
    name: echo
    runs-on: ubuntu-latest
    outputs:
        additional_materials: ${{ steps.echo.outputs.additional_materials }}
    steps:
      - name: Echo
        id: echo
        run: |
            echo "additional_materials="ghcr.io/chainloop-dev/chainloop/control-plane:v0.88.0,ghcr.io/chainloop-dev/chainloop/artifact-cas:v0.88.0"" >> $GITHUB_OUTPUT

  github_release:
    name: GitHub Release
    uses: ./.github/workflows/chainloop_github_release.yml
    needs: testing-echo
    with:
      project: "chainloop"
      workflow_name: "javi-github-release"
      additional_materials: ${{ needs.testing-echo.outputs.additional_materials }}
    secrets:
      api_token: ${{ secrets.CHAINLOOP_API_TOKEN }}

The additional_materials variable has been passed correctly:

[migmartri]

I'd appreciate if you can mark the PR as draft while you do testing/add changes. I am not sure if I should review this now or wait.

Thanks!

[javirln]

I'd appreciate if you can mark the PR as draft while you do testing/add changes. I am not sure if I should review this now or wait.

Thanks!

It can be reviewed.