Next generation tooling move-in

[puerco]

After sunsetting the previous tools, we are ready move the next generation of the tooling into the SKSA organization (ref #1641 ). This issue is intended to track the work items and also serve as a discussion point for the repository set-up, structure and configuration.

Move-in Plan

• Move the new verifier
  The new verifier will be pushed to slsa-framework/verifier. The first commit will be to update all the import paths in the code.

• Move the new attester
  The new attester that replaces the generator go code will be moved into slsa-framwork/attester.

• Create a new slsa-framework/protos repository
  This directory will hold the repatriated protobuf definitions for the slsa build predicates, VSA and the (unofficial) source provenance predicate.

  • Repatriate the protobuf definitions

• Rename slsa-framework/source-actions to slsa-framework/actions
  The rename intends to signal that the repository will contain the actions and workflows for the other slsa tracks.
  Note: I had to re-create the old source-actions repos as github does not redirect the workflows to the new location :(

• Update source tool automation
  Once we rename the actions repo, we will update sourcetool to make all its automation write the new URLs.
  - Point workflow automation at slsa-framework/actions and pin to latest release source-tool#444
  - Add support to migrate to new actions repo source-tool#446

• Add CI for tests, release, etc

• Harden the repositories

User Notices

As we are moving in things, setting up and testing we will add notices to the new repositories to inform that the tooling is being set up so that folks dont start using and depending on it before it's ready.