Also publish the signatures as part of the release

Signed-off-by: Marco Franssen <marco.franssen@philips.com>

.goreleaser.yml

@@ -106,38 +106,38 @@ signs:
     artifacts: checksum
     args:
       - sign-blob
-      - --yes
       - --key
       - cosign.key
       - '--output-certificate=${certificate}'
       - '--output-signature=${signature}'
       - '${artifact}'
+      - --yes
   - id: binaries
     cmd: cosign
     stdin: '{{ .Env.COSIGN_PASSWORD }}'
     output: true
     artifacts: binary
     args:
       - sign-blob
-      - --yes
       - --key
       - cosign.key
       - '--output-certificate=${certificate}'
       - '--output-signature=${signature}'
       - '${artifact}'
+      - --yes
   - id: archives
     cmd: cosign
     stdin: '{{ .Env.COSIGN_PASSWORD }}'
     output: true
     artifacts: archive
     args:
       - sign-blob
-      - --yes
       - --key
       - cosign.key
       - '--output-certificate=${certificate}'
       - '--output-signature=${signature}'
       - '${artifact}'
+      - --yes
 
 docker_signs:
   - artifacts: all
@@ -146,10 +146,10 @@ docker_signs:
     output: true
     args:
       - 'sign'
-      - --yes
       - --key
       - cosign.key
-      - '${artifact}'
+      - '${artifact}@${digest}'
+      - --yes
 
 snapshot:
   name_template: "{{ .Version }}-next"
@@ -173,6 +173,7 @@ changelog:
 release:
   prerelease: auto
   extra_files:
-    - glob: "./cosign.pub"
+    - glob: ./cosign.pub
+    - glob: dist/*.sig
   footer: |
     **Full Changelog**: https://github.com/philips-labs/slsa-provenance-action/compare/{{ .PreviousTag }}...{{ .Tag }}