Serving images (only) do not seem to have attestation information.

[evankanderson]

Works:

cosign download attestation $(curl -L https://github.com/knative/eventing/releases/download/knative-v1.12.1/eventing-core.yaml | grep 'image: [a-z]' | head -1 | cut -d: -f2-) | jq -r .payload | base64 --decode | jq

Does not work:

cosign download attestation $(curl -L https://github.com/knative/serving/releases/download/knative-v1.12.2/serving-core.yaml | grep 'image: [a-z]' | head -1 | cut -d: -f2-) | jq -r .payload | base64 --decode | jq

(Error is: main.go:74: error during command execution: found no attestations). I think this is because we aren't setting ATTEST_IMAGES in the serving release job. A grep -L ATTEST_IMAGES *.yaml suggests that Serving is the only repo missed.

I have a PR.