feat: publish Tekton Bundle on release

[vdemeester]

Changes

Publish the git-clone Task as a Tekton Bundle on every release.

Release workflow additions

Three new steps in the goreleaser job, after the container image is built and before it's signed:

1. Install tkn — via tektoncd/actions/setup-tektoncd-cli (pinned to commit SHA)
2. Push bundle — tkn bundle push to ghcr.io/tektoncd-catalog/git-clone/bundle:{tag} and :latest
3. Sign bundle — cosign signs the bundle digest (same key/flow as the container image)

Usage

taskRef:
  resolver: bundles
  params:
    - name: bundle
      value: ghcr.io/tektoncd-catalog/git-clone/bundle:v1.4.0
    - name: name
      value: git-clone
    - name: kind
      value: task

Closes #113

Submitter Checklist

• Includes tests for new or changed functionality
• Includes docs for user-facing changes
• Commit messages follow best practices
• Meets the Tekton contributor standards

Release Notes

Publish git-clone Task as a signed Tekton Bundle to ghcr.io on every release.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please ask for approval from vdemeester after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[vdemeester]

TODO before merge: Once #111 (e2e tests) lands, add a bundle e2e test to this PR.

Plan: push the bundle to ttl.sh (anonymous, auto-expires) and run a TaskRun that references it via the bundle resolver. No local registry setup needed.

tkn bundle push "ttl.sh/git-clone-e2e-${GITHUB_RUN_ID}:1h" -f task/git-clone/git-clone.yaml

taskRef:
  resolver: bundles
  params:
    - name: bundle
      value: ttl.sh/git-clone-e2e-<run-id>:1h
    - name: name
      value: git-clone