Support for multiple images with push-to-registry

[smlx]

My release workflow uses GoReleaser to build multiple images, push them to a registry, and then attest them using a config like this:

    # attest images
    - uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
      with:
        subject-checksums: ./dist/digests.txt
        push-to-registry: true

Recently since I bumped the version of the attest action I see an error message:

Error: Error: push-to-registry requires exactly one subject but 4 subjects were resolved

This seems to be a result of #447.

Is this behaviour intentional? Can this action be updated to support pushing attestations for multiple images?

I believe this is expected to work based on the GoReleaser docs which mention this action.

[bdehamer]

@smlx this is definitely something that we'd like to support. This restriction was initially put in place back when many of the popular registries didn't have good support for associating artifacts with images and we'd see high error rates when trying to attach attestations to multiple images in the same request. It's probably time to revisit this limitation.

To be clear, it may be that the error message you're seeing is new, but I believe the single-subject restriction has been in place since we added tha push-to-registry feature.