Make k8s keychain vs default keychain configurable

[marcofranssen]

https://github.com/philips-labs/slsa-provenance-action/releases/tag/v0.7.0-rc

https://github.com/philips-labs/slsa-provenance-action/actions/runs/1824661573

[codecov]

Codecov Report

Merging #130 (419b873) into main (9a1ac90) will decrease coverage by 0.38%.
The diff coverage is 40.00%.

@@            Coverage Diff             @@
##             main     #130      +/-   ##
==========================================
- Coverage   77.92%   77.54%   -0.39%     
==========================================
  Files          15       15              
  Lines         607      610       +3     
==========================================
  Hits          473      473              
- Misses         95       97       +2     
- Partials       39       40       +1     

Flag	Coverage Δ
unittests	77.54% <40.00%> (-0.39%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
lib/oci/auth.go	40.00% <25.00%> (-7.06%)	⬇️
cmd/slsa-provenance/cli/container.go	77.77% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9a1ac90...419b873. Read the comment docs.

[Brend-Smits]

I have been testing this in a private registry, but unfortunately, I don't think this is working yet.
Error is now: UNAUTHORIZED: authentication required, it is different than before.

[Brend-Smits]

Unfortunately, I think this is not yet resolved, internal testing shows that it is still an issue. This can either be in my workflow (am I missing some step), or in slsa action.
Thoughts?
https://github.com/philips-internal/internal-test-slsa-provenance-action

On the other hand, docker-ci-scripts is working. This makes me think the workflow is wrong.

[marcofranssen]

The rootcause of our problem is that we are running the slsa-provenance binary inside a Docker container in the action. Therefore the binary doesn't know about the docker login that happens outside of the container in a workflow.

We have 2 option here.

• Docker credentials passed to the action as inputs
• Only install the binary

[marcofranssen]

Please note, once this PR gets merged, our draft releases will fail. Due to different asset urls for draft releases. Not sure how to compute those.

[marcofranssen]

https://github.com/philips-labs/slsa-provenance-action/actions/runs/1840388657

It now also works for draft releases.