feat(goreleaser/goreleaser): add cosign config (#31881)

* refactor(goreleaser): make version constraints more maintainable

* feat(goreleaser/goreleaser): add checksums cosign config

pkgs/goreleaser/goreleaser/pkg.yaml

@@ -1,4 +1,6 @@
 packages:
   - name: goreleaser/goreleaser@v2.6.1
+  - name: goreleaser/goreleaser
+    version: v1.2.1
   - name: goreleaser/goreleaser
     version: v0.181.0

pkgs/goreleaser/goreleaser/registry.yaml

@@ -4,24 +4,55 @@ packages:
     repo_owner: goreleaser
     repo_name: goreleaser
     description: Deliver Go binaries as fast and easily as possible
-    replacements:
-      amd64: x86_64
-    asset: goreleaser_{{title .OS}}_{{.Arch}}.{{.Format}}
-    format: tar.gz
-    version_constraint: semver(">= 0.182.0")
-    overrides:
-      - goos: darwin
-        asset: goreleaser_{{title .OS}}_all.tar.gz
-      - goos: windows
-        format: zip
+    version_constraint: "false"
     version_overrides:
-      # https://github.com/goreleaser/goreleaser/pull/2572
-      # macOS Universal binaries
+      - version_constraint: semver("< 0.182.0")
+        asset: goreleaser_{{title .OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
+        replacements:
+          amd64: x86_64
+        checksum:
+          type: github_release
+          asset: checksums.txt
+          algorithm: sha256
+        overrides:
+          - goos: windows
+            format: zip
+      - version_constraint: semver("<= 1.2.1")
+        asset: goreleaser_{{title .OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
+        replacements:
+          amd64: x86_64
+        checksum:
+          type: github_release
+          asset: checksums.txt
+          algorithm: sha256
+        overrides:
+          - goos: darwin
+            asset: goreleaser_{{title .OS}}_all.{{.Format}}
+          - goos: windows
+            format: zip
       - version_constraint: "true"
+        asset: goreleaser_{{title .OS}}_{{.Arch}}.{{.Format}}
+        format: tar.gz
+        replacements:
+          amd64: x86_64
+        checksum:
+          type: github_release
+          asset: checksums.txt
+          algorithm: sha256
+          cosign:
+            opts:
+              - --certificate-identity
+              - https://github.com/goreleaser/goreleaser/.github/workflows/release.yml@refs/tags/{{.Version}}
+              - --certificate-oidc-issuer
+              - https://token.actions.githubusercontent.com
+              - --signature
+              - https://github.com/goreleaser/goreleaser/releases/download/{{.Version}}/checksums.txt.sig
+              - --certificate
+              - https://github.com/goreleaser/goreleaser/releases/download/{{.Version}}/checksums.txt.pem
         overrides:
+          - goos: darwin
+            asset: goreleaser_{{title .OS}}_all.{{.Format}}
           - goos: windows
             format: zip
-    checksum:
-      type: github_release
-      asset: checksums.txt
-      algorithm: sha256