Merge pull request #161 from smlx/attestv2

fix: avoid internal goreleaser cosign

Author: smlx

.github/workflows/lint.yaml

@@ -35,6 +35,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
-    - uses: docker://rhysd/actionlint:latest@sha256:2eb91a78b5a19140be099c7b4262d298c2567f2a9f27e10ed2a4323c5bcface8
+    - uses: docker://rhysd/actionlint:1.7.0@sha256:601d6faeefa07683a4a79f756f430a1850b34d575d734b1d1324692202bf312e
       with:
         args: -color

.goreleaser.yaml

@@ -22,18 +22,6 @@ builds:
 changelog:
   use: github-native
 
-signs:
-- cmd: cosign
-  signature: "${artifact}.sig"
-  certificate: "${artifact}.pem"
-  args:
-  - "sign-blob"
-  - "--output-signature=${signature}"
-  - "--output-certificate=${certificate}"
-  - "${artifact}"
-  - "--yes"
-  artifacts: checksum
-
 dockers:
 - ids:
   - go-cli-github
@@ -63,14 +51,6 @@ docker_manifests:
   - "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/go-cli-github:v{{ .Version }}-amd64"
   - "ghcr.io/{{ .Env.GITHUB_REPOSITORY }}/go-cli-github:v{{ .Version }}-arm64v8"
 
-docker_signs:
-- args:
-  - "sign"
-  - "${artifact}@${digest}"
-  - "--yes"
-  artifacts: all
-  output: true
-
 release:
   extra_files:
   - glob: "{{ .Env.GITHUB_SBOM_PATH }}"