Add universal chainguard enforce commit signing config

This adds a universal chianguard enforce commit signing config. This
supports all keyless and github verified signing methods, and covers
all humans and trusted robots.

Such config is universal, and will continue to work across repository
renames and moves.

If desired, the config can be locked down further but so far we
haven't managed to make enforce a required check but hopefully such
wide policy can actually be ratcheted to be made required as any and
all signing methods are supported and trusted.

Author: xnox

.chainguard/source.yaml

@@ -0,0 +1,29 @@
+# Copyright 2025 Chainguard, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+spec:
+  authorities:
+    - keyless:
+        identities:
+          # Humans
+          - issuer: https://github.com/login/oauth
+          # Humans and service accounts
+          - issuer: https://accounts.google.com
+          # Github actions from chainguard orgs main branches
+          - issuer: https://token.actions.githubusercontent.com
+            subjectRegExp: ^https://github.com/chainguard-demo/.*/\.github/workflows/.*@refs/heads/main$
+          - issuer: https://token.actions.githubusercontent.com
+            subjectRegExp: ^https://github.com/chainguard-dev/.*/\.github/workflows/.*@refs/heads/main$
+          - issuer: https://token.actions.githubusercontent.com
+            subjectRegExp: ^https://github.com/chainguard-forks/.*/\.github/workflows/.*@refs/heads/main$
+          - issuer: https://token.actions.githubusercontent.com
+            subjectRegExp: ^https://github.com/chainguard-images/.*/\.github/workflows/.*@refs/heads/main$
+          - issuer: https://token.actions.githubusercontent.com
+            subjectRegExp: ^https://github.com/chainguard-sandbox/.*/\.github/workflows/.*@refs/heads/main$
+          - issuer: https://token.actions.githubusercontent.com
+            subjectRegExp: ^https://github.com/octo-sts/.*/\.github/workflows/.*@refs/heads/main$
+          - issuer: https://token.actions.githubusercontent.com
+            subjectRegExp: ^https://github.com/wolfi-dev/.*/\.github/workflows/.*@refs/heads/main$
+  # Any github verified
+  github:
+    verified: true