Merge pull request #16374 from subhamkrai/add-cosign

build: use cosign to sign the images/helm charts

.github/workflows/push-build.yaml

@@ -15,6 +15,7 @@ defaults:
 permissions:
   contents: read
   packages: write
+  id-token: write  # for cosign OIDC keyless signing
 
 jobs:
   push-image-to-container-registry:
@@ -36,6 +37,9 @@ jobs:
         with:
           platforms: all
 
+      - name: Install cosign
+        uses: sigstore/cosign-installer@4ea7c83ed23e5b1b86ff0db87c63b87e4d72c410 # v3.8.0
+
       - name: log in to container registry
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with: