feat(action): Create new action to consume GitHub releases

[javirln]

This patch uses changes introduced in #820 to auto discover materials based on the GitHub releases' assets.

Changes:

• Uses the workflow chainloop-vault-release
• Rename the file from github_release to release
• Attests everything included on the GitHub Release

Refs #785

[migmartri]

We need to decide how this is going to co-exist/replace with our current release job/attestation. Do you have any thoughts on that transition?

[javirln]

We need to decide how this is going to co-exist/replace with our current release job/attestation. Do you have any thoughts on that transition?

I had a look at it the other day and we are indeed adding some values twice. We could leave the old release to the following:

• Create all the binaries with goreleaser
• Attest plugins since they are not part of the GitHub releases
• Generate all SBOMS from source code
• Create PR for Chart bump

goreleaser will take care of the majority of the heavy lifting by attesting all remaining binaries and container images. From the GitHub release workflow we could:

• Attest all binaries except plugins
• Attest all SBOMS generated on the previous step part for the GitHub release
• Attest all container images

That would require changing the current release contract.

[javirln]

Other option on the table:

• Remove duplicates on release workflow
• Use this reusable workflow as parte of the release one
• Add in different attestation the missing pieces such as the plugins binaries and container images (they would be removed from the GitHub release workflow)

That would also require changes on the release contract as well.

[jiparis]

Other option on the table:

• Remove duplicates on release workflow
• Use this reusable workflow as parte of the release one
• Add in different attestation the missing pieces such as the plugins binaries and container images (they would be removed from the GitHub release workflow)

That would also require changes on the release contract as well.

I would go this way, leaving this one as generic as possible and keeping the specifics in the current one.
I'd also investigate how to put all this logic in a Github Action instead of a reusable workflow. Maybe as part of a different effort.

[javirln]

I would remove the container images from this one, open a new PR to include it on the Release. Please keep in mind that this will create two different attestations that might not be related more from the commit.