feat: sign release artifacts with cosign

Refs #2462

Author: scop

.github/workflows/release.yml

@@ -7,6 +7,9 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write  # for cosign
     env:
       # https://github.com/actions/setup-go#supported-version-syntax
       # ex:
@@ -57,6 +60,9 @@ jobs:
       - name: Install snapcraft
         run: sudo snap install snapcraft --classic
 
+      - name: Set up cosign
+        uses: sigstore/cosign-installer@v3
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 

.goreleaser.yml

@@ -87,6 +87,16 @@ release:
 
     For key updates, see the [changelog](https://golangci-lint.run/product/changelog/#{{ .Major }}{{ .Minor }}{{ .Patch }}).
 
+signs:
+  - signature: ${artifact}.cosign.bundle
+    cmd: cosign
+    args:
+      - sign-blob
+      - --bundle=${signature}
+      - --yes
+      - ${artifact}
+    artifacts: checksum
+
 source:
   enabled: true
   name_template: '{{ .ProjectName }}-{{ .Version }}-source'