Add option to suppress job summary

[Pesa]

I'd like to disable the built-in job summary and instead generate my own attestation summary and combine it with the summary that I'm already generating for the job. In order to do this, I'd need to:

• pass a flag (or env variable) to actions/attest-build-provenance to suppress the generation of the built-in job summary
• obtain the attestation URL as an output of actions/attest-build-provenance (AFAICS the action doesn't currently provide this information)

[bdehamer]

@Pesa do you have a preference for how the attestation URL output should look? It would be pretty straightforward if there was only ever a single attestation generated. But with the possibility of multiple attestations, it's a bit more complex . . .

• A comma-separate list of URLs: https://github.com/foo/bar/attestations/1317853,https://github.com/foo/bar/attestations/1317854
• A comma-separated list of attestation IDs: 1317853,1317854
• JSON: ['https://github.com/foo/bar/attestations/1317853','https://github.com/foo/bar/attestations/1317854']

Other ideas?

[Pesa]

Ah, good question. I did not think of the case of multiple attestations. I don't have a strong preference, I've seen other actions use either JSON, comma-separated, or newline-separated lists. I suppose using JSON would be the most general, flexible, and future-proof approach (action consumers can use fromJSON to access individual IDs/URLs), though one could also say it's the most overkill.

An additional issue is that it's not obvious what artifact each attestation ID corresponds to. A possibly overkill solution would be to output a JSON object for each generated attestation, containing: subject-name, subject-digest, attestation-id, attestation-url.

[bdehamer]

There is some work to do still to figure out the best way to output the list of attestation links, but the 1.4.0 release does give you the option to suppress the summary output.