fix(sign-and-attest): disable release-asset upload on image SBOM step

[zircote]

Summary

sign-and-attest.yml's docker-sign (attest) job failed on go-htmx's
first tagged release (v0.1.0, run
29222949104)
after the image was already correctly signed and the SBOM already
generated, at the anchore/sbom-action step:

##[error]Resource not accessible by integration - https://docs.github.com/rest

Root cause

anchore/sbom-action defaults to upload-release-assets: true, which
tries to attach the SBOM file to a GitHub Release matching the run's
tag name via the REST API. This job only grants contents: read
(correctly, per least-privilege), so the attach call 403s. The failure
aborts the job after the useful work (signing, SBOM generation) is
already done, and skips every downstream job in the caller's chain
(docker-verify, gate-image, attest-container-scan in go-htmx's
case) since they all needs: this job.

The SBOM is already published as a cosign-attested OCI referrer two
steps later in the same job (cosign attest --predicate sbom.cdx.json --type cyclonedx), so the action's own upload side effects are
redundant, not just failing. Caller repos' own binary-path sbom jobs
already disable this identical default with the identical rationale
(see e.g. go-htmx's release.yml).

Fix

Set upload-artifact: false and upload-release-assets: false on the
SBOM generation step, matching the established pattern.

Impact on already-tagged releases

This does not retroactively fix any run already frozen against the old
pinned SHA (reusable uses: refs pinned by commit SHA resolve to that
exact commit regardless of what merges to main afterward). Any caller
repo that already hit this on a tagged release will need a new tag (or
manual completion of the missing attestation) to get a fully-attested
container image — that decision belongs to each caller repo's owner,
not this fix.

Verification

• actionlint .github/workflows/sign-and-attest.yml passes clean.
• Diff is additive-only (two new keys on an existing step); does not
  change any other job, permission, or pinned action SHA.

[Copilot]

Pull request overview

Fixes a failure mode in the reusable sign-and-attest.yml workflow where the SBOM generation step attempts to upload release assets using insufficient permissions, causing the docker-sign/attest job to fail after successful signing/SBOM generation and thereby blocking downstream jobs.

Changes:

• Disable anchore/sbom-action side-effect uploads (upload-artifact and upload-release-assets) for the image SBOM step.
• Add inline rationale documenting why these uploads must be disabled (least-privilege contents: read and SBOM is already published via cosign attestation).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.