End-to-End Supply Chain Security for a Go Project: TUF on CI, cosign, and SLSA L3

Adding cosign sign to a CI pipeline and calling it "signed releases" is a bit like putting a lock on...