fixup! fixup! fixup! feat: use GoReleaser Pro for split/merge CGO builds

.github/workflows/go-release-cgo.yaml

@@ -161,8 +161,6 @@ jobs:
           cgo-enabled: "1"
           github-token: ${{ secrets.GITHUB_TOKEN }}
           goreleaser-key: ${{ secrets.GORELEASER_PRO }}
-          cosign-key: ${{ secrets.COSIGN_KEY }}
-          cosign-password: ${{ secrets.COSIGN_PASSWORD }}
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
@@ -175,6 +173,10 @@ jobs:
     name: Release
     needs: [version, build]
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -203,8 +205,6 @@ jobs:
           mode: merge
           github-token: ${{ secrets.GITHUB_TOKEN }}
           goreleaser-key: ${{ secrets.GORELEASER_PRO }}
-          cosign-key: ${{ secrets.COSIGN_KEY }}
-          cosign-password: ${{ secrets.COSIGN_PASSWORD }}
 
       - name: Rolling release
         if: inputs.rolling-release-tag != ''

.github/workflows/go-release.yaml

@@ -73,6 +73,10 @@ jobs:
     needs: version
     if: needs.version.outputs.version_tag != ''
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -108,8 +112,6 @@ jobs:
           mode: full
           github-token: ${{ secrets.GITHUB_TOKEN }}
           homebrew-tap-token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
-          cosign-key: ${{ secrets.COSIGN_KEY }}
-          cosign-password: ${{ secrets.COSIGN_PASSWORD }}
 
       - name: Rolling release
         if: inputs.rolling-release-tag != ''