wip: prototype artifact blob signing with cosign #1

	name: Signing Prototype

	on:
	push:
	branches:
	- signed-binaries

	permissions:
	# required for OIDC token used as the signing identity
	id-token: write

	# required to publish the release
	contents: write

	jobs:
	goreleaser:
	# deploy with the correct environment to allow DockerHub access
	environment: "Publish"

	runs-on: ubuntu-latest
	steps:

	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Configure Go
	uses: actions/setup-go@v5
	with:
	go-version-file: go.mod

	- name: Install Cosign
	uses: sigstore/cosign-installer@v3
	with:
	cosign-release: 'v2.4.0'

	# we're not releasing to Dockerhub on this branch
	# - name: Login to Docker Hub
	# uses: docker/login-action@v3
	# with:
	# username: ${{ secrets.DOCKERHUB_USER }}
	# password: ${{ secrets.DOCKERHUB_TOKEN }}

	- name: Release
	uses: goreleaser/goreleaser-action@v5
	with:
	distribution: goreleaser
	version: v2.3.2
	args: build --snapshot --config .goreleaser-prototype.yaml --clean
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Archive build
	uses: actions/upload-artifact@v4
	with:
	name: snapshot
	path: dist
	retention-days: 5

Provide feedback