Allow API tokens to create attestations

[jiparis]

To ease the automatic onboarding of workflows, organizations might configure an API token globally, and then use it for creating the attestations. This means that:

• org ID will be provided by the API token
• workflow ID will be provided as an option in the CLI

The benefit of this approach would be organizations don't need to create a single robot account for each workflow (which could be problematic in orgs with dozens of jobs)

This change must be backwards compatible with current authz mechanisms, so we might need to rework the middlewares to allow multiple token providers.

This change should also be aligned with other potential authentication mechanisms, like using GitHub tokens, or any other ID provider.

Tasks

Beta Give feedback

1. Add Workflow create to the resource types
2. Add Attestation resource to the resource types
3. Create a policy to create Attestations
4. Map attestation API to the Attestations Policy
5. Add attestations policy to the default policies for API tokens
6. Add workflow-name command line option for attestations using API tokens

[migmartri]

Is there anything left here?

[javirln]

Is there anything left here?

All done here, closing the issue.

[migmartri]

There were (are) two things missing

• document the attestaiton process with API tokens in the docs
• use it in one of our workflows

Are these completed?

[javirln]

There were (are) two things missing

• document the attestaiton process with API tokens in the docs
• use it in one of our workflows

Are these completed?

They are in progress.

[migmartri]

ok, are you tracking them in another task or smth? Should we reopen this issue? Whatever you prefer :)

[javirln]

I'm using this one: https://github.com/chainloop-dev/platform/issues/630