Disable the verification of GitHub Artifact Attestations if GitHub Access Token isn't set

[suzuki-shunsuke]

Feature Overview

Disable the verification of GitHub Artifact Attestations if GitHub Access Token isn't set.

Why is the feature needed?

GitHub CLI requires a GitHub Access token but aqua doesn't require it basically.
If we start using GitHub Artifact Attestations for packages, we can't install them without a GitHub Access token anymore.
It's undesirable.

#3156

https://github.com/aquaproj/aqua/actions/runs/11170325776/job/31052920228

INFO[0000] gh attestation verify failed temporarily, retring  aqua_version= env=linux/amd64 package_name=suzuki-shunsuke/mkghtag package_version=v0.1.5-3 program=aqua registry=standard retry_count=2 wait_time=634ms
gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable. Example:
  env:
    GH_TOKEN: ${{ github.token }}
WARN[0001] execute gh attestation verify                 aqua_version= args="attestation verify /tmp/329480978 -R suzuki-shunsuke/mkghtag --signer-workflow suzuki-shunsuke/go-release-workflow/.github/workflows/release.yaml" env=linux/amd64 error="exit status 4" exe=/home/runner/.local/share/aquaproj-aqua/pkgs/github_release/github.com/cli/cli/v2.57.0/gh_2.57.0_linux_amd64.tar.gz/gh_2.57.0_linux_amd64/bin/gh package_name=suzuki-shunsuke/mkghtag package_version=v0.1.5-3 program=aqua registry=standard

Workaround

Pass a GitHub Access token to GitHub CLI somehow.

In GitHub Actions:

env:
  GITHUB_TOKEN: ${{github.token}}

On your laptop:

export GITHUB_TOKEN=<your github token>

Example Code

No response

Note

For now (aqua-registry v4.228.0), no package uses GitHub Artifact Attestations.
So you can install them without a GitHub Access Token.
No worries about that.