fix: enable id token for cosign #5

	name: Release

	# This GitHub action creates a release when a tag that matches the pattern
	# "v*" (e.g. v0.1.0) is created.
	on:
	push:
	tags:
	- 'v*'

	# Releases need permissions to read and write the repository contents.
	# GitHub considers creating releases and uploading assets as writing contents.
	permissions:
	contents: write
	id-token: write # This is required for requesting the JWT

	jobs:
	goreleaser:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
	with:
	# Allow goreleaser to access older tag information.
	fetch-depth: 0
	- uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
	with:
	go-version-file: 'go.mod'
	cache: true
	- name: Install Cosign
	uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
	- name: Run GoReleaser
	uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
	with:
	args: release --clean
	env:
	# GitHub sets the GITHUB_TOKEN secret automatically.
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback