Switch 'sigstore-probe' to copy the prober from the image rather than rebuilding every execution

[evankanderson]

Summary

Start work on #94. We currently see a fair amount of build flakiness (failed to fetch go library X) in the GitHub sigstore probes. By reducing this to two fetches (crane and the OCI image), we should hopefully see less flakiness.

Or I screwed everything up, and one probe will alert and we'll roll this back before trying again. (I'll try to get this running in my fork as well, but I wanted to offer this for review since I'd been sitting on it half-done for a while.)

Release Note

• Reduce external dependencies and work needed for sigstore-probe probes in staging and production.

Documentation

No documentation needed.

[evankanderson]

Successful execution, will fix DCO:

https://github.com/evankanderson/sigstore-probers/actions/runs/6697424637/job/18197276780

[evankanderson]

@bobcallaway should approve / merge this if he wants it this week.

[bobcallaway]

why not just bake crane into the image?

[evankanderson]

We're currently building the prober image with ko, which produces a single-binary image. (It doesn't even have cp to copy the file out of the image, or any other binaries besides the prober itself.)

I was trying to avoid adding a lot of new machinery (build new image with go / make / etc) in order to replace the existing images which we already have built and released.

I can look at building an image for these, but the retry action used later on means that we'll need to copy the binaries out of the image into some other location.

[bobcallaway]

gcr.io/go-containerregistry/crane is regularly published

[bobcallaway]

should this also be listed in a fake Dockerfile (and extracted here) so that Dependabot will see it and flag updates for it?

[cpanato]

Is this still relevant?