for sake of traceability and auditability, it would be great to add support for pushing ghasum action checksums to rekor attestations.