Add signer-digest, source-ref, and source-digest options for gh attestation verify - #10308

This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [cli/cli](https://github.com/cli/cli) | minor | `v2.67.0` -> `v2.68.0` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>cli/cli (cli/cli)</summary>

### [`v2.68.0`](https://github.com/cli/cli/releases/tag/v2.68.0): GitHub CLI 2.68.0

[Compare Source](cli/cli@v2.67.0...v2.68.0)

#### What's Changed

##### ✨ Features

-   \[gh repo view] Improve error message for forked repo by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10334
-   Add signer-digest, source-ref, and source-digest options for `gh attestation verify` by [@&#8203;malancas](https://github.com/malancas) in cli/cli#10308
-   \[gh pr checkout] Add --no-tags option to git fetch commands in checkout by [@&#8203;latzskim](https://github.com/latzskim) in cli/cli#10479
-   \[`gh issue/pr comment`] Add `--create-if-none` and prompts to create a comment if no comment already exists  by [@&#8203;latzskim](https://github.com/latzskim) in cli/cli#10427
-   \[gh cache delete --all] Add `--succeed-on-no-caches` flag to return exit code 0 by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10327
-   \[gh release create] Fail when there are no new commits since the last release by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10398
-   update default upstream when forking repo during MR creation by [@&#8203;daviddl9](https://github.com/daviddl9) in cli/cli#10458

##### 🐛 Fixes

-   Refactor `GetLocalAttestations` and clean up custom registry transport by [@&#8203;malancas](https://github.com/malancas) in cli/cli#10382
-   Check `GH_REPO` too in addition to `--repo` for disambiguation by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#10539
    -   (Fixes `gh secret` subcommands not working outside of a repository)
-   Fix unhandled panic in FindWorkflow and add tests by [@&#8203;jtmcg](https://github.com/jtmcg) in cli/cli#10521
-   Fix checkout when URL arg is from fork and cwd is upstream by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#10512
-   \[gh api] Escape package name (URL encoding) for packages endpoint by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10384
-   Fix `remoteResolver` caching issue by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10456
-   Fix gh project item-edit to allow --number 0 as a valid value by [@&#8203;aryanbhosale](https://github.com/aryanbhosale) in cli/cli#10417
-   Add mutex to fix race in attestation test client by [@&#8203;codysoyland](https://github.com/codysoyland) in cli/cli#10439
-   Base64 decode GPG passphrase in deployment workflow by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#10546

##### 📚 Docs & Chores

-   Deep Dive Document Release Process by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#10503
-   Inconsistent format of examples in help text by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10508
-   Inconsistent format of description of flags (starting with lowercase letter) by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10507
-   Update Go version to 1.23 in CONTRIBUTING.md by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#10504
-   Fix minor auth login help typo by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#10501
-   docs: document how to revoke `gh` OAuth tokens in `auth logout`'s help by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#10490
-   chore: update codespaces Go version by [@&#8203;BagToad](https://github.com/BagToad) in cli/cli#10491
-   Allow injection of TUFMetadataDir in tests by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#10478
-   refactor: use a more straightforward return value by [@&#8203;beforetech](https://github.com/beforetech) in cli/cli#10489
-   Use subtests in attestation verification integration tests by [@&#8203;williammartin](https://github.com/williammartin) in cli/cli#10463
-   Fix typo in README by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10445
-   Update usage to lower-kebab-case by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10447
-   Standardize URLs by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10429
-   Remove trailing whitespace by [@&#8203;iamazeem](https://github.com/iamazeem) in cli/cli#10430

#####  Dependencies

-   Bump actions/attest-build-provenance from 2.2.0 to 2.2.2 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10518
-   Bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10499
-   Bump github.com/spf13/pflag from 1.0.5 to 1.0.6 by [@&#8203;dependabot](https://github.com/dependabot) in cli/cli#10338

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOS4xODYuMCIsInVwZGF0ZWRJblZlciI6IjM5LjE4Ni4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiXX0=-->

…ends

gh attestation verify first shipped in 2.49.0, but the --source-ref and
--signer-workflow flags this command sends need 2.68.0 (cli/cli#10308). A gh
between those versions has the attestation subcommand but not the flags, and
fails with "unknown flag" rather than "unknown command", so the too-old check
missed it and reported a merely-outdated gh as a failed or tampered
verification instead of telling it to upgrade. Recognize both wordings and
state 2.68.0 as the floor everywhere it is quoted: the refusal message, the
update command's help text, and the docs.

Also tidies a misleading test comment (HandleReleaseDownload records the tag
argument, it does not assert it) and drops the fake's unused Tag property.

…ends

gh attestation verify first shipped in 2.49.0, but the --source-ref and
--signer-workflow flags this command sends need 2.68.0 (cli/cli#10308). A gh
between those versions has the attestation subcommand but not the flags, and
fails with "unknown flag" rather than "unknown command", so the too-old check
missed it and reported a merely-outdated gh as a failed or tampered
verification instead of telling it to upgrade. Recognize both wordings and
state 2.68.0 as the floor everywhere it is quoted: the refusal message, the
update command's help text, and the docs.

Also tidies a misleading test comment (HandleReleaseDownload records the tag
argument, it does not assert it) and drops the fake's unused Tag property.

…w 2.68 is not a verifier; a SHA pin picks a published release (#319)

* fix(release): GitHub's Latest moves only after the provenance attestation exists

GoReleaser publishes the release before actions/attest-build-provenance runs,
so make_latest from UPGRADESCOPE_NEWEST made a release without an attestation
Latest for as long as the attestation took (for good if it failed, and again
on every re-run of the job), and the Action's `version: latest` failed on it.

.goreleaser.yml now hard-codes make_latest "false". The goreleaser job's last
step, which runs only when every earlier step succeeded, is the only one that
sets Latest, for the highest published stable release (including the first).
The image's :latest is unchanged. hack/release-newest_test.sh pins the literal,
the order, and that a failed attestation skips the step. IR-17 updated.

Refs #303, #304, #305

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix(action): a SHA pin takes the newest published release at the commit; gh without --source-ref is no verifier

At a commit SHA the Action tried the newest release tag there without
checking its release exists, so a tagged-but-unpublished commit failed on a
404 and suggested turning provenance off. It now walks the tags newest first
(GET releases/tags/<tag>, with the workflow token when set) and uses the
first published one; tags with no published release fail, naming them and
saying to pin a published version, never falling back to latest.

gh 2.49 to 2.67 has `attestation verify` but not --source-ref (first in
2.68.0, cli/cli#10308, read from the source at the release tags), so every
verified install failed as "a replaced release asset". The Action now asks
`gh attestation verify --help` once for every flag the call passes; a gh
that lacks one is treated like a gh without `attestation`: cosign when it is
on PATH, otherwise "gh 2.68 or later (or cosign) is needed to verify
provenance". 2.49 becomes 2.68 in run.sh, both action.yml files, the Action
README, the CI gate guide and AC-06; AC-03b updated.

Refs #303, #304, #305

Co-Authored-By: Claude Fable 5 <[email protected]>

* docs(action): GitHub's latest moves only after the attestation exists

Refs #303, #304, #305

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix(release,action): Latest moves only to a run's own attested release; the SHA probe is anonymous off github.com

release.yml: the closing step moved Latest to the highest published stable
release even when it belonged to another run, which GoReleaser has published
before that run attests it. A lower racing run could name an unattested
release Latest, reopening #304. A run now moves Latest only to its own
release, and only when that is the highest; :latest is unchanged.

run.sh: the releases/tags probe sent github.token to api.github.com on
GitHub Enterprise Server and GHE.com, where it is rejected (401) and made
every SHA-pinned install fail. The token is sent only on github.com; the
failure message names the HTTP status. The gh attestation failure message
says a release not attested yet fails the same way.

Docs: ci-gate.md and the README version row describe the published-tag walk,
IR-17 and AC-03b are updated, gh_min cites v2.51.0 for --signer-workflow.

Refs #303, #304, #305

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix(action): only a 200 from releases/tags is published; the token stays off curl's argv

curl -f fails from HTTP 400 and the probe follows no redirect, so a 2xx or 3xx
(a 301 after a repository rename) counted as published and fell through to the
no_archive error that suggests verify-provenance: false. Only 200 is published
now; any other non-404 answer is "cannot tell", naming the HTTP status.

The token goes to curl as a config on stdin (-K -), not -H on argv, where other
users of a shared runner can read it. The unpublished-tag error also says the
release run may have failed. Comments and IR-17 note that a hand-moved Latest is
restored only by the highest release's own run.

Refs #303, #304, #305

Co-Authored-By: Claude Fable 5 <[email protected]>

* fix(action,release): CI's gh-spy check expects the --help probe; rate-limited SHA probe falls back; Latest decided by version

- ci.yml: the action asks gh for `attestation verify --help` once and then
  runs one verify, so the spy log has two lines. The check required exactly
  one, which failed the v0.2.0-rc.2 step on both runners. It now expects the
  passing --help first and the verify second, and the install assertions are
  their own step. hack/action_test.sh runs the spy step's and the check's
  scripts from ci.yml against run.sh's gh path (and refuses seven wrong logs),
  so the check cannot drift from the action again.
- run.sh: the no-gh failure also says gh 2.68 or later (or cosign) is needed.
  On a 403 or 429 from the releases/tags probe (the anonymous 60 an hour on
  GHES and GHE.com), the tag's checksums.txt download decides: 200 is
  published, 404 is not; the README documents the exposure.
- release.yml: the closing step decides "is this the highest" with
  release-newest.sh is-newest, as every other step does, not a tag string
  comparison; the header says what a re-run of the Latest release's
  goreleaser job does with make_latest=false (GitHub's REST reference does
  not define it, the closing step restores Latest). The make_latest test
  shows the offending lines when it fails.

Refs #303, #304, #305

Co-Authored-By: Claude Fable 5 <[email protected]>

* docs(action): say the release workflow never points latest at an unverifiable release, and name IR-17's exceptions

Refs #304

Co-Authored-By: Claude Fable 5 <[email protected]>

---------

Co-authored-by: Claude Fable 5 <[email protected]>