feat(suzuki-shunsuke/mkghtag): verify GitHub Artifact Attestations

pkgs/suzuki-shunsuke/mkghtag/pkg.yaml

@@ -1,4 +1,6 @@
 packages:
-  - name: suzuki-shunsuke/[email protected]
+  - name: suzuki-shunsuke/[email protected]
+  - name: suzuki-shunsuke/mkghtag
+    version: v0.1.4
   - name: suzuki-shunsuke/mkghtag
     version: v0.1.0

pkgs/suzuki-shunsuke/mkghtag/registry.yaml

@@ -30,6 +30,29 @@ packages:
             format: zip
             slsa_provenance:
               enabled: false
+      - version_constraint: semver("<= 0.1.4")
+        asset: mkghtag_{{.OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
+        overrides:
+          - goos: windows
+            format: zip
+        slsa_provenance:
+          type: github_release
+          asset: multiple.intoto.jsonl
+        checksum:
+          type: github_release
+          asset: mkghtag_{{trimV .Version}}_checksums.txt
+          algorithm: sha256
+          cosign:
+            opts:
+              - --certificate-identity-regexp
+              - "https://github\\.com/suzuki-shunsuke/go-release-workflow/\\.github/workflows/release\\.yaml@.*"
+              - --certificate-oidc-issuer
+              - "https://token.actions.githubusercontent.com"
+              - --signature
+              - https://github.com/suzuki-shunsuke/mkghtag/releases/download/{{.Version}}/mkghtag_{{trimV .Version}}_checksums.txt.sig
+              - --certificate
+              - https://github.com/suzuki-shunsuke/mkghtag/releases/download/{{.Version}}/mkghtag_{{trimV .Version}}_checksums.txt.pem
       - version_constraint: "true"
         asset: mkghtag_{{.OS}}_{{.Arch}}.{{.Format}}
         format: tar.gz
@@ -39,10 +62,14 @@ packages:
         slsa_provenance:
           type: github_release
           asset: multiple.intoto.jsonl
+        github_artifact_attestations:
+          signer-workflow: suzuki-shunsuke/go-release-workflow/.github/workflows/release.yaml
         checksum:
           type: github_release
           asset: mkghtag_{{trimV .Version}}_checksums.txt
           algorithm: sha256
+          github_artifact_attestations:
+            signer-workflow: suzuki-shunsuke/go-release-workflow/.github/workflows/release.yaml
           cosign:
             opts:
               - --certificate-identity-regexp