Offline verification: refactor to make it clear no signature checks a… #18

	name: release

	# run only on tags
	on:
	push:
	tags:
	- 'v*'

	permissions:
	contents: write # needed to write releases
	id-token: write # needed for keyless signing

	jobs:
	release:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
	with:
	fetch-depth: 0 # this is important, otherwise it won't checkout the full tree (i.e. no previous tags)

	- uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
	with:
	go-version: '1.20'
	check-latest: true

	- uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
	with:
	path: ~/go/pkg/mod
	key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
	restore-keys: \|
	${{ runner.os }}-go-

	- uses: sigstore/cosign-installer@dd6b2e2b610a11fd73dd187a43d57cc1394e35f9 # v3.0.5
	with:
	cosign-release: 'v2.0.0' # optional
	- uses: anchore/sbom-action/download-syft@4d571ad1038a9cc29d676154ef265ab8f9027042 # v0.14.2
	- uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b # v4.2.0
	with:
	version: latest
	args: release --rm-dist
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback