[tooky]

Summary

Follow-up to #1377, which tied the default GitHub signer for kosli attest in-toto to the current run and pinned the help examples to a workflow file and its ref. A signer regexp that accepts any workflow on any ref lets anyone who can push a branch produce an attestation that records as verified: true.

The SBOM bundle example still accepts any signer under the repository URL. The CLI reference is generated from this help text, so that is what users copy. This PR changes only that example, in cmd/kosli/attestInToto.go:

 # record the SBOM attestation from the same build, as app.sbom:
 kosli attest in-toto app.tar.gz \
 	--bundle app-sbom.sigstore.json \
 	--predicate-type sbom \
 	--name app.sbom \
-	--certificate-identity-regexp '^https://github.com/yourOrg/yourRepo/' \
+	--certificate-identity https://github.com/yourOrg/yourRepo/.github/workflows/build.yml@refs/heads/main \
 	--certificate-oidc-issuer https://token.actions.githubusercontent.com \

The new value is the one the neighbouring provenance example uses. No other help text, sample workflow or doc in the repo has a regexp that accepts any workflow or any ref. The regexps in hack/empty-flag-audit/spec.json are audit fixtures, not examples, so they're unchanged. Command behaviour doesn't change.

Evidence

• kosli attest in-toto --help now shows the SBOM example with --certificate-identity …/.github/workflows/build.yml@refs/heads/main, matching the other examples.
• Build, lint and tests pass. No golden file covers this example.

Merge Danger

Door: two-way. It's a one-line help-text change.
Blast Radius: the generated CLI reference page for kosli attest in-toto, and nothing at runtime.

[claude]

Claude finished @tooky's task in 1m 5s —— View job

---

PR review

• Ran static checks: go build, go vet and go mod tidy
• Reviewed the diff
• Posted the review

No blocking issues; LGTM. The SBOM bundle example at cmd/kosli/attestInToto.go:276 now names one workflow file on one ref. The old regexp matched any workflow under the repository on any ref. The new value matches the adjacent provenance example, and no example still passes a loose regexp. All static checks pass.

I left two optional nits in the review comment:

• Line 249 uses yourGithubOrg/yourGithubRepo, while the other examples use yourOrg/yourRepo.
• No example now shows a safe, anchored --certificate-identity-regexp.