Summary

Add an hourly scheduled workflow that monitors the public-good Rekor transparency log for AICR's release supply chain: log consistency (append-only) and AICR's release signing identity.

Motivation / Context

AICR signs its releases and logs them to Rekor, but nothing watched the log itself. This adds detection for two risks: an entry appearing under AICR's release identity that a release did not produce (OIDC/key compromise), and the log no longer being append-only. It protects the trust root every AICR consumer depends on (release binaries, signed recipe catalog, container images all chain to that one identity).

Fixes: #1460
Related: #1149

Type of Change

• New feature (non-breaking change that adds functionality)
• Documentation update
• Build/CI/tooling

Component(s) Affected

• Docs/examples (docs/, examples/)
• Other: CI workflows (.github/workflows)

Implementation Notes

• Calls the upstream sigstore/rekor-monitor reusable workflow (reusable_monitoring.yml). A single run does both required behaviors: RunConsistencyCheck advances/verifies the append-only checkpoint, and IdentitySearch scans entries added since the last checkpoint for the configured identity. Identity monitoring is incremental by design (new entries since last checkpoint), which is why the checkpoint artifact is retained.
• Monitored identity is AICR's release signer (per .goreleaser.yaml and .github/workflows/on-tag.yaml): certSubject regex for on-tag.yaml@refs/tags/*, issuers pinned to token.actions.githubusercontent.com.
• Pinned to a main commit SHA (170374c…); upstream has no tags/releases. Matches the repo convention of SHA-pinning actions with a version/date comment.
• Least-privilege: top-level permissions: {}; the job grants only contents: read, issues: write, id-token: write (exactly what the reusable workflow requires). A concurrency group with cancel-in-progress: false serializes runs without killing an in-flight checkpoint write.
• url is intentionally unset so the monitor uses the public-good default and discovers current log shards (including Rekor v2) via TUF, rather than hardcoding an endpoint that could drift.
• artifact_retention_days: 30 comfortably exceeds the hourly cron so the consistency checkpoint never expires between runs.
• Triage runbook lives in the workflow header to avoid doc drift; docs/contributor/maintaining.md adds a short pointer.

Testing

actionlint .github/workflows/rekor-monitor.yaml   # OK
yamllint -c .yamllint.yaml .github/workflows/rekor-monitor.yaml   # OK

No Go source changed, so make test / coverage gates do not apply. A scheduled workflow cannot run from a branch; after merge, workflow_dispatch can trigger a manual run on main to confirm it executes and files an issue correctly.

Risk Assessment

• Low — Additive, isolated CI workflow plus a docs pointer; trivially revertible by deleting the workflow file.

Rollout notes: No migration. First scheduled run establishes the baseline consistency checkpoint and begins scanning forward; it does not retroactively sweep historical entries.

Checklist

• Linter passes (actionlint + yamllint)
• I did not skip/disable tests to make CI green
• I updated docs (maintainer runbook pointer)
• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)

No Go code changed, so unit tests / new tests are not applicable.