build: Add support for new cosign bundle

Signed-off-by: Paulo Gomes <[email protected]>

Author: pjbgf

.goreleaser.yaml

@@ -24,13 +24,12 @@ archives:
 
 signs:
   - cmd: cosign
-    certificate: '${artifact}.pem'
+    signature: "${artifact}.sigstore.json"
     args:
       - sign-blob
       - '--yes'
-      - '--output-signature=${signature}'
-      - '--output-certificate=${certificate}'
-      - '--bundle=${artifact}.bundle'
+      - '--new-bundle-format=true'
+      - '--bundle=${signature}'
       - '${artifact}'
     artifacts: checksum
     output: true
@@ -44,7 +43,3 @@ sboms:
     artifacts: source
     documents:
       - '{{ .ProjectName }}_{{ .Version }}_sbom.spdx.json'
-
-release:
-  extra_files:
-    - glob: ./**/*.bundle