Grant id-token write for cosign OIDC signing

[dfarrell07]

Grants id-token: write on the release workflow so shipyard's cosign keyless signing (FIND-015) can mint a GitHub OIDC token from inside the Dapper container.

Effective only after shipyard's FIND-015 change merges and the shipyard-dapper-base image is rebuilt/republished.

See commit messages for details.

Summary by CodeRabbit

• Chores
  • Updated the release process permissions to support secure, keyless artifact signing.

[submariner-bot]

🤖 Created branch: z_pr4142/dfarrell07/glasswing-pr8-release-0.20
🚀 Full E2E won't run until the "ready-to-test" label is applied. I will add it automatically once the PR has 2 approvals, or you can add it manually.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bc4903a9-63dc-423f-adba-58357bbe30b7

📥 Commits

Reviewing files that changed from the base of the PR and between 6cb8173 and 6d03b47.

📒 Files selected for processing (1)

• .github/workflows/release.yml

Included review availability: Your plan provides up to 8 included reviews per hour; 2 remain after this review.

---

Walkthrough

The release workflow replaces its empty permissions configuration with id-token: write and contents: read permissions for Sigstore keyless signing.

Changes

Release signing permissions

Layer / File(s)	Summary
Configure release workflow permissions .github/workflows/release.yml	The workflow grants id-token: write and contents: read permissions.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 6d03b

This narrowly changes release workflow permissions to enable cosign OIDC signing, and no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• submariner-io/submariner#4138: Makes the identical release workflow permissions change.
• submariner-io/submariner#4137: Makes the same permissions change for Sigstore signing.
• submariner-io/submariner#4139: Adds the same permissions for Sigstore/Cosign OIDC signing.

Suggested reviewers: skitt, vthapar, sridhargaddam

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: granting the GitHub OIDC token permission for cosign signing.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Actionable Comments Resolved	✅ Passed	GitHub API shows zero review comments and zero reviews; the two issue comments are bot status messages, not actionable review requests.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}