Grant id-token write for cosign OIDC signing

[dfarrell07]

Grants id-token: write on the release workflow so shipyard's cosign keyless signing (FIND-015) can mint a GitHub OIDC token from inside the Dapper container.

Effective only after shipyard's FIND-015 change merges and the shipyard-dapper-base image is rebuilt/republished.

See commit messages for details.

Summary by CodeRabbit

• Security
  • Enabled secure, keyless signing for automated releases.
  • Retained read-only access to repository contents during release workflows.

[submariner-bot]

🤖 Created branch: z_pr4144/dfarrell07/glasswing-pr8-release-0.18
🚀 Full E2E won't run until the "ready-to-test" label is applied. I will add it automatically once the PR has 2 approvals, or you can add it manually.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f1f2d436-63cd-47f7-9bca-b53db9934834

📥 Commits

Reviewing files that changed from the base of the PR and between 271140c and f00ad95.

📒 Files selected for processing (1)

• .github/workflows/release.yml

Included review availability: Your plan provides up to 8 included reviews per hour; 0 remain after this review.

---

Walkthrough

The release workflow now grants id-token: write and contents: read permissions. This enables Sigstore OIDC-based keyless signing while preserving read-only repository access.

Changes

Release workflow permissions

Layer / File(s)	Summary
Enable OIDC and repository read permissions .github/workflows/release.yml	The workflow changes from no permissions to id-token: write and contents: read.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to f00ad

This localized workflow permission change is merge-ready after normal checks and review, with no actionable merge-blocking risk remaining.

Possibly related PRs

• submariner-io/submariner#4138: Makes the same release workflow permission changes for cosign OIDC signing.
• submariner-io/submariner#4141: Makes the same release.yml permission changes.
• submariner-io/submariner#4140: Enables the same cosign OIDC signing permissions.

Suggested reviewers: skitt, vthapar, sridhargaddam

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: granting the workflow permission required for cosign OIDC signing.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Actionable Comments Resolved	✅ Passed	GitHub API reports zero reviews and zero inline review comments; the two issue comments contain only bot status and review-processing notices, with no actionable requests.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}