Tekton task to sign with ambient creds

sign-with-ambient.yaml

apiVersion: tekton.dev/v1beta1
kind: Task
metadata:
  name: sign-with-ambient
spec:
  params:
    - name: digest
      description: The digest to sign

  steps:
    # The Goal:
    # - name: sign-result
    #   image: gcr.io/projectsigstore/cosign
    #   args: [sign, -f, -upload, $(params.digest)]

    - name: sign-result
      # Produced with:
      #   docker-credential-magician mutate \
      #      gcr.io/projectsigstore/cosign/ci/cosign:3f83940d3f3d97075d606af1e0793051cc6fc19b \
      #      -t ghcr.io/mattmoor/cosign:magic
      image: ghcr.io/mattmoor/cosign:magic
      env:
      # Enable keyless signing using the identity token for OIDC
      - name: COSIGN_EXPERIMENTAL
        value: "1"
      args: [sign, -f, -upload, $(params.digest)]

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: kaniko
  annotations:
    # Allow the workloads run as kaniko to impersonate this robot, created with:
    #   gcloud iam service-accounts create kaniko-workload
    #   gcloud iam service-accounts add-iam-policy-binding --role roles/iam.workloadIdentityUser --member "serviceAccount:mattmoor-credit.svc.id.goog[default/kaniko]" kaniko-workload@mattmoor-credit.iam.gserviceaccount.com
    #   gcloud projects add-iam-policy-binding mattmoor-credit --member=serviceAccount:kaniko-workload@mattmoor-credit.iam.gserviceaccount.com --role=roles/storage.admin
    iam.gke.io/gcp-service-account: kaniko-workload@mattmoor-credit.iam.gserviceaccount.com