[fix] Adopt cosign new bundle format for goreleaser signing (#326)

[fix] Adopt cosign new bundle format so goreleaser signing succeeds

cosign v3 (shipped with sigstore/cosign-installer@v4.1.2) enables
--new-bundle-format by default, which silently ignores
--output-signature / --output-certificate and expects --bundle instead.
With no --bundle path supplied, cosign opened an empty path and aborted
with "create bundle file: open : no such file or directory".

Replace the signs block with the bundle format: a single
checksums.txt.bundle file that embeds both signature and cert.

Author: lugassawan

.github/workflows/release-dryrun.yml

@@ -0,0 +1,36 @@
+name: Release Dry-Run
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".goreleaser.yaml"
+      - ".github/workflows/release.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - ".goreleaser.yaml"
+      - ".github/workflows/release.yml"
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  release-dryrun:
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      - uses: goreleaser/goreleaser-action@v7
+        with:
+          args: release --snapshot --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yaml

@@ -34,11 +34,10 @@ sboms:
 
 signs:
   - cmd: cosign
-    certificate: "${artifact}.pem"
+    signature: "${artifact}.bundle"
     args:
       - sign-blob
-      - "--output-certificate=${certificate}"
-      - "--output-signature=${signature}"
+      - "--bundle=${signature}"
       - "${artifact}"
       - "--yes"
     artifacts: checksum