v2.0.1

What's new

Adds the release pipeline that turns every pushed v*.*.* tag into
a signed image at ghcr.io/airvzxf/ftp-deployment-action with an
attached CycloneDX SBOM, automatically. The pipeline:

1. builds the Docker image with docker/build-push-action@v6,
2. pushes to ghcr.io/airvzxf/ftp-deployment-action:v<version> and
   :<version>, with OCI image labels,
3. generates a CycloneDX SBOM with anchore/sbom-action@v0,
4. signs the image with cosign sign --yes (keyless, OIDC),
5. attaches the SBOM as an in-toto attestation with actions/attest@v4.

Also pins the Dockerfile to a known-good digest
(alpine@sha256:25109184...) and pins the apk package versions,
which resolves the hadolint DL3018 warning that was open since
the first PR.

Behaviour

v2.0.1 is behaviour-preserving for end users. The action's
runs.image stays on 'Dockerfile' in action.yml (which uses
the local Dockerfile in the repo); the published
ghcr.io/airvzxf/ftp-deployment-action:v2.0.1 is a side benefit
for anyone who wants to inspect the supply chain or pull the
image outside of the action context.

The action's input contract is unchanged from v2.0.0. The next
v2.x.y tag will go through the same pipeline automatically.

Verified

• ghcr.io/airvzxf/ftp-deployment-action:v2.0.1 is published.
• cosign verify --certificate-identity-regexp 'https://github.com/airvzxf/ftp-deployment-action' --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' ghcr.io/airvzxf/ftp-deployment-action:v2.0.1 succeeds.
• The SBOM is downloadable from the workflow run as
  sbom.cyclonedx.json (CycloneDX 1.6, 289 components).
• The build workflow run is
  https://github.com/airvzxf/ftp-deployment-action/actions/runs/28730866556.

Assets

• Image: ghcr.io/airvzxf/ftp-deployment-action:v2.0.1
• Source: https://github.com/airvzxf/ftp-deployment-action/tree/v2.0.1
• CHANGELOG: https://github.com/airvzxf/ftp-deployment-action/blob/v2.0.1/CHANGELOG.md
• SBOM: download from the workflow artifacts