Fix goreleaser problem for SLSA generation

[laurentsimon]

There is a problem in goreleaser which causes the SLSA provenance generation to fail: goreleaser/goreleaser-action#368

This PR is a temporary fix to the problem, as suggested in the tracking issue above.

/cc @johanbrandhorst

[laurentsimon]

Note: this PR may no longer be necessary given goreleaser/goreleaser-action#369.
@johanbrandhorst, please re-run a release to confirm, and drop this PR ;-)

[johanbrandhorst]

Thanks for this, I think we'll wait until the next release and see if it works again :). Lets close this for now.

[johanbrandhorst]

Looks like it failed again 😞: https://github.com/grpc-ecosystem/grpc-gateway/actions/runs/3267086141/jobs/5371809177

[laurentsimon]

Pinning the builder by hash is currently not supported https://github.com/grpc-ecosystem/grpc-gateway/blob/master/.github/workflows/release.yml#L43
See https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators for why (limitation of GitHub APIs)

[johanbrandhorst]

Ugh, I see. That was automatically applied by our dependency updater. Could you update it back to the latest stable version? Thanks!

[laurentsimon]

I will send a PR, sure!
We're about to release a new builder version, so let ,e wait till it lands. I think next week.