feat(goreleaser/goreleaser): add cosign config

[scop]

https://github.com/goreleaser/goreleaser/releases

Check List

• Read CONTRIBUTING.md
  • Read OSS Contribution Guide
• All commits are signed
  • This repository enables Require signed commits, so all commits must be signed
• Avoid force push
• Install and execute the package and confirm if the package works well
• Execute cmdx s to scaffold code

[scop]

This differs a from most existing cosign configs by using --certificate-identity (not --certificate-identity-regexp) and by using the exact identity of the release. Wondering if this is ok, or if there's a specific reason to use the regexp version and not being this strict?

[suzuki-shunsuke]

No problem.
I don't remember why we used --certificate-identity-regexp, but I think we should use --certificate-identity as much as possible.

[suzuki-shunsuke]

I remenber why we use --certificate-identity-regexp.
If GitHub Actions Reusable Workflows are used, the certificate-identity is the reusable workflow's URL such as https://github.com/suzuki-shunsuke/go-release-workflow/.github/workflows/release.yaml@v0.1.0.
We didn't want to fix the setting every time the reusable workflow is updated, so we used regular expressions @.*.
But if reusable workflows aren't used, I think --certificate-identity is better.

[suzuki-shunsuke]

Thank you!