Automated release workflow permission updates

[rlieberman-splunk]

Description

Fixes the automated-release-workflow.yml GitHub Actions workflow, which was failing at multiple steps due to a permissions misconfiguration and cosign signature verification issues against Docker Hub.

Key Changes

• Fixed OIDC permissions for AWS credential authentication: The job-level permissions block was overriding the workflow-level block, silently dropping id-token: write. This prevented aws-actions/configure-aws-credentials from obtaining an OIDC token to assume the AWS role. Added id-token: write to the job-level permissions block so it is preserved alongside the existing contents: write and pull-requests: write.

• Fixed cosign sign/verify for image on Docker Hub: Added COSIGN_DOCKER_MEDIA_TYPES: "1" to both the sign and verify steps for splunk/splunk-operator. Docker Hub uses Docker media types rather than OCI media types, which caused cosign to store and look up signatures in mismatched formats, resulting in no signatures found. All other workflows in this repo sign against ECR (which uses OCI media types natively) and are unaffected.

• Fixed cosign sign/verify for images on Docker Hub: Added COSIGN_DOCKER_MEDIA_TYPES: "1" to both the sign and verify steps. Docker Hub uses Docker media types rather than OCI media types, which caused cosign to store and look up signatures in mismatched formats, resulting in no signatures found. All other workflows in this repo sign against ECR (which uses OCI media types natively) and are unaffected. Additionally, added --recursive to cosign sign for the because they are multi-arch OCI image index. Without --recursive, cosign signs only the index manifest in a way that is incompatible with how verify resolves the tag against a multi-arch index; --recursive ensures all platform manifests and the index itself are signed.

Testing and Verification

Changes were validated by iteratively triggering the workflow_dispatch workflow from the hotfix/release-workflow-perms branch and confirming each previously failing step passed:

• Create artifacts and promote RC image: https://github.com/splunk/splunk-operator/actions/runs/23762087315/job/69232002956
• Sign operator image and promote distroless RC image: https://github.com/splunk/splunk-operator/actions/runs/23762499461/job/69233455266
• Sign distroless image: https://github.com/splunk/splunk-operator/actions/runs/23762845744/job/69234649872
• Verify distroless image: https://github.com/splunk/splunk-operator/actions/runs/23762985987/job/69235144647

Related Issues

https://splunk.atlassian.net/browse/CSPL-4146

PR Checklist

• Code changes adhere to the project's coding standards.
• Relevant unit and integration tests are included.
• Documentation has been updated accordingly.
• All tests pass locally.
• The PR description follows the project's guidelines.