Add options for Rekor client, make public key fetcher configurable. (… #19

	name: release

	# run only on tags
	on:
	push:
	tags:
	- 'v*'

	permissions:
	contents: write # needed to write releases
	id-token: write # needed for keyless signing

	jobs:
	release:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
	with:
	fetch-depth: 0 # this is important, otherwise it won't checkout the full tree (i.e. no previous tags)

	- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
	with:
	go-version: '1.21'
	check-latest: true

	- uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
	with:
	path: ~/go/pkg/mod
	key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
	restore-keys: \|
	${{ runner.os }}-go-

	- uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
	with:
	cosign-release: 'v2.0.0' # optional
	- uses: anchore/sbom-action/download-syft@78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 # v0.14.3
	- uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
	with:
	version: latest
	args: release --rm-dist
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback