Create a slsa-scorecard.yml workflow

[asraa]

This would

1. Use gitHub hosted runners
2. Use the scorecard action and run analysis
3. Use sigstore in keyless mode to sign and push the scorecard results as a blob on GitHub registry

[laurentsimon]

This would

1. Use gitHub hosted runners
2. Use the scorecard action and run analysis

let's start with JSON for the first iteration, then use in-toto?

3. Use sigstore in keyless mode to sign and push the scorecard results as a blob on GitHub registry

start with GH registry for first iteration, then use rekor?

[asraa]

start with GH registry for first iteration, then use rekor?

Might be confused about this -- "start with JSON for first iteration, then use in-toto" do you mean?

if so, then yes!

[laurentsimon]

this may be useful for us goreleaser/goreleaser#2659 for a go PoC