fix(release): sign checksums as sigstore bundle for cosign v3

cosign v3 ignores --output-signature/--output-certificate under the new
bundle format and fails on the empty --bundle path. Emit
checksums.txt.sigstore.json instead; update verify docs.

Author: qaiser42

.goreleaser.yaml

@@ -56,15 +56,17 @@ sboms:
 signs:
   - id: cosign
     cmd: cosign
-    signature: "${artifact}.sig"
-    certificate: "${artifact}.pem"
-    # No explicit --oidc-provider/--oidc-issuer: cosign v3 rejects service
-    # URLs when its signing config is active, and it auto-detects the GitHub
-    # Actions ambient OIDC token anyway.
+    # cosign v3: keyless via ambient GitHub Actions OIDC (explicit
+    # --oidc-* flags conflict with its signing config), and signature +
+    # certificate ship together in a sigstore bundle instead of separate
+    # .sig/.pem files. Verify with:
+    #   cosign verify-blob --bundle checksums.txt.sigstore.json checksums.txt \
+    #     --certificate-identity-regexp 'github.com/qaiser42/stackit-nuke' \
+    #     --certificate-oidc-issuer https://token.actions.githubusercontent.com
+    signature: "${artifact}.sigstore.json"
     args:
       - sign-blob
       - "--yes"
-      - "--output-certificate=${certificate}"
-      - "--output-signature=${signature}"
+      - "--bundle=${signature}"
       - "${artifact}"
     artifacts: checksum

docs/releases.md

@@ -12,10 +12,9 @@ Releases are produced by the [`release`](https://github.com/qaiser42/stackit-nuk
 ## Verifying a release
 
 ```bash
-# checksum signature
+# checksum signature (sigstore bundle contains signature + certificate)
 cosign verify-blob \
-  --certificate checksums.txt.pem \
-  --signature   checksums.txt.sig \
+  --bundle checksums.txt.sigstore.json \
   --certificate-identity-regexp 'github.com/qaiser42/stackit-nuke' \
   --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
   checksums.txt