Update attestation script to include README.md in artifact attestations and enhance README with detailed scenario description

Author: sofusalbertsen

multi-repo-attestation/1.sh

@@ -25,7 +25,7 @@ tree -L 4
 cd devbox-demo
 echo "Current directory: $(pwd)"
 echo "Attesting devbox-demo repository"
-kosli attest generic --name app.sbom --trail ${GIT_COMMIT} --commit ${GIT_COMMIT} --attachments  README.md
 kosli attest generic --name app.sbom --trail ${GIT_COMMIT} --attachments  LICENSE
+kosli attest generic --name app.sbom --trail ${GIT_COMMIT} --commit ${GIT_COMMIT} --attachments  README.md
 
 kosli get trail -o json ${GIT_COMMIT} > data.json

multi-repo-attestation/README.md

@@ -2,3 +2,41 @@
 
 Create a scenario where you clone down a 2nd repo, and performs an attestation in that. What git commit is stored in kosli? And if you provide a --commit, are both then stored?
 
+## Scenario
+
+* Clone down the this repo
+* Attest one artifact
+* Clone down another repo: https://github.com/sofusalbertsen/devbox-demo
+* Attest files from the second repo with two different styles:
+  * attest to the trail
+  * Attest to the trail AND the HEAD commit from parent repo.
+
+Repo looks like this:
+
+```Bash
+.
+├── LICENSE
+├── README.md
+├── artifact.txt
+├── devbox-demo # Two files from a different git repo.
+│   ├── LICENSE
+│   └── README.md
+├── multi-repo-attestation
+│   ├── 1.sh
+│   ├── README.md
+│   └── kosli-config
+│       └── flow.yaml
+├── multi-trail-artifact
+│   ├── 1.sh
+│   ├── README.md
+│   ├── kosli-config
+│   │   └── flow.yaml
+│   └── show-trails.sh
+└── template-complete
+    ├── 1.sh
+    ├── 2.sh
+    ├── README.md
+    ├── check-template-complete.sh
+    └── kosli-config
+        └── flow.yaml
+```