feat(source-commit): Update source-commit to enforce signature verification (#2665)

Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Author: javirln

.github/workflows/codeql.yml

@@ -44,6 +44,9 @@ jobs:
         if: ${{ github.event_name != 'pull_request' }}
         run: |
           chainloop attestation init --workflow $CHAINLOOP_WORKFLOW_NAME --project $CHAINLOOP_PROJECT
+        env:
+          # Needed for commit signature verification: https://docs.chainloop.dev/concepts/attestations#commit-verification
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Go
         uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1

.github/workflows/contracts/chainloop-vault-codeql.yml

@@ -16,6 +16,7 @@ spec:
       - ref: source-commit
         with:
           check_signature: yes
+          check_author_verified: yes
         requirements:
           - chainloop-best-practices/commit-signed
   policyGroups:

.github/workflows/contracts/chainloop-vault-helm-package.yml

@@ -22,6 +22,7 @@ spec:
       - ref: source-commit
         with:
           check_signature: yes
+          check_author_verified: yes
         requirements:
           - chainloop-best-practices/commit-signed
     materials:

.github/workflows/contracts/chainloop-vault-release.yml

@@ -10,6 +10,7 @@ spec:
       - ref: source-commit
         with:
           check_signature: yes
+          check_author_verified: yes
         requirements:
           - chainloop-best-practices/commit-signed
       - ref: containers-with-sbom

.github/workflows/package_chart.yaml

@@ -90,6 +90,8 @@ jobs:
         env:
           COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_KEY}}
           COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
+          # Needed for commit signature verification: https://docs.chainloop.dev/concepts/attestations#commit-verification
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Finish and Record Attestation
         if: ${{ success() }}

.github/workflows/release.yaml

@@ -37,6 +37,8 @@ jobs:
           CHAINLOOP_TOKEN: ${{ secrets.CHAINLOOP_TOKEN }}
           CHAINLOOP_WORKFLOW_NAME: "release"
           CHAINLOOP_PROJECT_NAME: "chainloop"
+          # Needed for commit signature verification: https://docs.chainloop.dev/concepts/attestations#commit-verification
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   release:
     name: Release CLI and control-plane/artifact-cas container images