Add JFrog RLM evidence collection GitHub Actions workflow

[jmatias]

Motivation

• Provide a concrete GitHub Actions example that demonstrates JFrog Release Lifecycle Management (RLM) with evidence collection and signed attestations.
• Show how to automate early signing of release candidates to reduce risk of tampering or accidental changes.
• Demonstrate managing binaries in SDLC-aligned repositories (RC vs production) and creating Release Bundles for promotion.
• Illustrate pre-deployment integrity verification of a release using JFrog Evidence Collection (EVC) and promotion only after verification.

Description

• Add a new workflow file at .github/workflows/jfrog-rlm-evidence.yml that runs on push to main and via workflow_dispatch and configures id-token OIDC permissions.
• Implement build steps: make build, upload artifacts to an RC repo using jf rt upload, and collect build metadata with jf rt build-collect-env and jf rt build-add-git.
• Generate an SBOM using anchore/sbom-action@v0, install cosign via sigstore/cosign-installer@v3, and create a keyless signed attestation using cosign attest.
• Attach signed evidence to the build with jf evc add, publish build info with jf rt build-publish, create a Release Bundle with jf rbc, verify evidence with jf evc verify, and promote the bundle to the production repo with jf rbd.

Testing

• No automated tests were executed for this change because it is a workflow-only addition; the workflow can be validated by triggering workflow_dispatch or pushing to main to observe runtime behavior.

---

Codex Task

[Copilot]

Pull request overview

This PR adds a comprehensive GitHub Actions workflow for demonstrating JFrog Release Lifecycle Management (RLM) with evidence collection and signed attestations. The workflow automates the process of building, signing, verifying, and promoting release candidates through SDLC-aligned repositories.

Key changes:

• Implements a two-job workflow with OIDC authentication for JFrog CLI
• Automates build artifact upload to RC repo, SBOM generation, and keyless attestation signing
• Establishes evidence verification gates before promoting release bundles to production

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The cosign attest command is attempting to attest a repository path rather than a specific artifact. The subject should be a concrete artifact (like a file digest or specific binary path) rather than a directory path. This will likely fail or produce an invalid attestation since cosign expects a specific artifact reference or digest to attest.

Suggested change

	"${RC_REPO}/podinfo/${GITHUB_SHA}/"
	"sbom.spdx.json"

[Copilot]

The 'rbd' command is missing required parameters for a complete Release Bundle distribution. According to JFrog CLI documentation, 'jf rbd' typically requires additional parameters such as '--signing-key' or '--target' to specify the distribution target. The current command only specifies the bundle name, version, project, and repo, which is insufficient for actual distribution.

[Copilot]

The COSIGN_EXPERIMENTAL environment variable is deprecated. As of cosign v2.0+, keyless signing is the default behavior and this environment variable is no longer needed. Using deprecated features may cause issues with newer versions of cosign or lead to unexpected behavior.

Suggested change

	env:
	COSIGN_EXPERIMENTAL: "1"

[Copilot]

The job name contains a space followed by a plus sign which may cause confusion. Consider using a more conventional format like 'Build and Attest RC' or 'Build & Attest RC' for better readability and consistency with standard naming conventions.

Suggested change

	name: Build + attest RC
	name: Build and attest RC

[Copilot]

The job name contains a space followed by a plus sign which may cause confusion. Consider using a more conventional format like 'Verify and Promote to Production' or 'Verify & Promote to Production' for better readability and consistency with standard naming conventions.

Suggested change

	name: Verify + promote to production
	name: Verify and promote to production