Enhance community release workflow, same as the other components

.github/workflows/release.yml

@@ -5,55 +5,108 @@ on:
 
 permissions:
   contents: write
+  id-token: write
+  attestations: write
+  artifact-metadata: write
 
 env:
   WF_REGISTRY_USER: netobserv+cli_github_ci
   WF_ORG: netobserv
   WF_MULTIARCH_TARGETS: amd64 arm64 ppc64le s390x
+  WF_REGISTRY_NAME: quay.io
+  WF_IMAGE_NAME: quay.io/netobserv/network-observability-cli
 
 jobs:
   push-image:
-    name: push image and prepare release
+    name: build and push release
     runs-on: ubuntu-latest
+
     steps:
       - name: checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           persist-credentials: false
+
       - name: validate tag
         run: |
           tag=`git describe --exact-match --tags 2> /dev/null`
-          if [[ $tag =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$ ]]; then
+          if [[ $tag =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-crc[0-9]+|-community)$ ]]; then
               echo "$tag is a valid release tag"
               set -e
               echo "tag=$tag" >> $GITHUB_ENV
           else
               echo "$tag is NOT a valid release tag"
               exit 1
           fi
+
       - name: install make
         run: sudo apt-get install make
       # QEMU and buildx needed for multiarch builds (otherwise, microdnf step fails)
       - name: Set up QEMU dependency
         uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+
       - name: docker login to quay.io
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           username: ${{ env.WF_REGISTRY_USER }}
           password: ${{ secrets.QUAY_SECRET }}
-          registry: quay.io
+          registry: ${{ env.WF_REGISTRY_NAME }}
+
       - name: build and push manifest with images
-        run: MULTIARCH_TARGETS="${{ env.WF_MULTIARCH_TARGETS }}" IMAGE_ORG=${{ env.WF_ORG }} VERSION=${{ env.tag }} CLEAN_BUILD=1 make images
-      - name: build plugin artifact
-        run: IMAGE_ORG=${{ env.WF_ORG }} VERSION=${{ env.tag }} make release
+        run: MULTIARCH_TARGETS="${WF_MULTIARCH_TARGETS}" IMAGE_ORG=${WF_ORG} VERSION=${tag} CLEAN_BUILD=1 make images
+
+      - name: build krew plugin artifact
+        run: IMAGE_ORG=${{ env.WF_ORG }} VERSION=${{ env.tag }} make krew-release
+
+      - name: capture image digest
+        id: image_digest
+        run: |
+          digest=$(docker buildx imagetools inspect ${WF_IMAGE_NAME}:${tag} \
+            --format '{{json .Manifest.Digest}}' | tr -d '"')
+          echo "digest=$digest" >> "$GITHUB_ENV"
+          echo "${WF_IMAGE_NAME}@$digest" >> ./release-assets/images
+
+      - name: cosign-installer
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6
+
+      - name: Sign and verify the image with GitHub OIDC Token
+        run: |
+          cosign sign --yes ${WF_IMAGE_NAME}@${digest}
+
+          cosign verify ${WF_IMAGE_NAME}@${digest} \
+            --certificate-identity=https://github.com/netobserv/netobserv-cli/.github/workflows/release.yml@refs/tags/${tag} \
+            --certificate-oidc-issuer=https://token.actions.githubusercontent.com
+
+      - name: Attest Provenance attestations
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
+        with:
+          subject-name: ${{ env.WF_IMAGE_NAME }}
+          subject-digest: ${{ env.digest }}
+          push-to-registry: true
+
+      - name: Generate SBOM
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
+        with:
+          image: ${{ env.WF_IMAGE_NAME }}@${{ env.digest }}
+          format: 'spdx-json'
+          output-file: './release-assets/sbom.spdx.json'
+
+      - name: Attest SBOM
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
+        with:
+          subject-name: ${{ env.WF_IMAGE_NAME }}
+          subject-digest: ${{ env.digest }}
+          sbom-path: './release-assets/sbom.spdx.json'
+          push-to-registry: true
+
       - name: create draft release and upload binaries
         uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           tag_name: ${{ env.tag }}
           name: ${{ env.tag }}
           draft: true
           prerelease: false
-          files: netobserv-cli.tar.gz
+          files: ./release-assets/*
           body: Edit to remove this content, click on 'generate release notes' above and publish. It will trigger the krew-release-bot.

Makefile

@@ -194,10 +194,12 @@ docs: oc-commands ## Generate asciidoc
 update-config: ## Update config from operator repo
 	./scripts/update-config.sh
 
-.PHONY: release
-release: clean ## Generate tar.gz containing krew plugin
+.PHONY: krew-release
+krew-release: clean ## Generate tar.gz containing krew plugin
 	$(MAKE) KREW_PLUGIN=true kubectl-commands
 	tar -czf netobserv-cli.tar.gz LICENSE ./build/netobserv
+	mkdir -p release-assets
+	mv netobserv-cli.tar.gz release-assets/
 
 .PHONY: create-kind-cluster
 create-kind-cluster: prereqs ## Create a kind cluster