chore(ci): tighten secret usage (#2537)

* chore: be explicit about secrets needed for image build

Instead of inheriting *all* the secrets we are only selectively giving
the called workflows access to the secrets we actually need. Currently
we only have one secret we use for image signing but in the future we
may want to have a separate testing key we use to sign testing builds
only made in PRs and things like that.

We may want to look into setting things up in a way so production keys
are only ever used when we push to ublue-os/aurora.

This also happens to make the experience a little bit nicer in new forks
as the workflow will fail right after the start when the SIGNING_SECRET
wasn't set, as opposed to when signing the image.

xref: https://github.com/ublue-os/aurora/issues/2528

* chore: remove secrets from generate-release parts

I don't know why this exists, we don't need our cosign key in this part
of the workflow.

.github/workflows/build-image-latest-main.yml

@@ -32,7 +32,8 @@ jobs:
       id-token: write
       attestations: write
       artifact-metadata: write
-    secrets: inherit
+    secrets:
+      SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
     strategy:
       fail-fast: false
       matrix:
@@ -52,7 +53,6 @@ jobs:
     needs: [build-image-latest]
     permissions:
       contents: write
-    secrets: inherit
     uses: ./.github/workflows/generate-release.yml
     with:
       stream_name: '["latest"]'

.github/workflows/build-image-stable.yml

@@ -26,7 +26,8 @@ jobs:
       id-token: write
       attestations: write
       artifact-metadata: write
-    secrets: inherit
+    secrets:
+      SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
     strategy:
       fail-fast: false
       matrix:
@@ -44,7 +45,6 @@ jobs:
     needs: [build-image-stable]
     permissions:
       contents: write
-    secrets: inherit
     uses: ./.github/workflows/generate-release.yml
     with:
       stream_name: '["stable"]'

.github/workflows/build-image-testing.yml

@@ -23,7 +23,8 @@ jobs:
       id-token: write
       attestations: write
       artifact-metadata: write
-    secrets: inherit
+    secrets:
+      SIGNING_SECRET: ${{ secrets.SIGNING_SECRET }}
     strategy:
       fail-fast: false
       matrix:

.github/workflows/reusable-build.yml

@@ -25,6 +25,9 @@ on:
         required: false
         type: boolean
         default: true
+    secrets:
+      SIGNING_SECRET:
+        required: true
 
 env:
   IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}