ci(.github): publish slsa artifacts to cloudsmith

[saisatishkarra]

Summary

• Source JIRA: https://konghq.atlassian.net/browse/SEC-1106
• Downloads SLSA workflow run assets from various jobs in CI using glob pattern on file extensions
• Upload the below cloudsmith packages in RAW package format:
• SBOMs: <repo>-sbom - Aggregated ZIP file with all SBOMs for image artifacts and Source Code from which binary was built
• Binary Provenance: <repo>-binary-provenance - ZIP file containing provenance for binary verification

Checklist prior to review

• Link to relevant issue as well as docs and UI issues --
• This will not break child repos: it doesn't hardcode values (.e.g "kumahq" as a image registry) and it will work on Windows, system specific functions like syscall.Mkfifo have equivalent implementation on the other OS --
• Tests (Unit test, E2E tests, manual test on universal and k8s) --
  • Don't forget ci/ labels to run additional/fewer tests
• Do you need to update UPGRADE.md? --
• Does it need to be backported according to the backporting policy? (this GH action will add "backport" label based on these file globs, if you want to prevent it from adding the "backport" label use no-backport-autolabel label) --

[saisatishkarra]

@lahabana Currently i tried working with actions/download-artifact@v4 and gh run download {run_id} -p <pattern> doesn't support downloading artifacts in a same workflow uploaded by other jobs until the workflow is completed. This is due to an issue in the upstream anchore/sbom-action that uses an older actions/upload-artifact@{v1,v2,v3}. There is an open PR but not merged.

i am looking to use workflow_run(doesn't support to only run on specific filtered tags) event to trigger a separate downstream workflow to push to cloudsmith and download assets after the caller (build-test-distribute.yml) is complete. I will refactor the PR and address your other suggestions.

LMK your thoughts if you have a way to approach this to solve for running a separate workflow to download assets filtered for specific tags / branches.

[lahabana]

i am looking to use workflow_run(actions/starter-workflows#1137) event to trigger a separate downstream workflow to push to cloudsmith and download assets after the caller (build-test-distribute.yml) is complete. I will refactor the PR and address your other suggestions.

Honestly I'm not super fan of workflow_run the event driven base of the execution just makes it hard to follow.
Calling it with workflow_call achieves the same (and it's what's done for other workflows in build-test-distribute or inline like it is here is fine too.

[saisatishkarra]

Waiting on @curiositycasualty to merge release-script PR and update the new version in this PR ⤴️

[saisatishkarra]

The PR is ready for review/merge with the updated release scripts that use the version passed by kuma / mesh. All review comments have been addressed.

@lahabana Looking for review/merge and port to KM and have a release tag until further review comments.

[github-actions]

backporting to release-2.5 with action

backporting to release-2.4 with action
backporting to release-2.7 with action