replace gcr.io/distroless/ to use ghcr.io/distroless/

[cpanato]

Summary

• replace gcr.io/distroless/ to use ghcr.io/distroless/ for testing

the images from gcr.io/distroless/ (https://github.com/GoogleContainerTools/distroless) are having issues with the signatures and then it is failing our tests, switching to images that we can have a bit more control (https://github.com/distroless/) and act fast in case of any issue.

for building images need a few more tests to check if everything will work as usual

Ticket Link

N/A

Release Note

NONE

[codecov-commenter]

Codecov Report

Merging #1961 (815cb52) into main (424f7db) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #1961   +/-   ##
=======================================
  Coverage   34.71%   34.71%           
=======================================
  Files         153      153           
  Lines       10037    10037           
=======================================
  Hits         3484     3484           
  Misses       6166     6166           
  Partials      387      387           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 424f7db...815cb52. Read the comment docs.

[dlorenc]

For context, the gcr images are great but regularly have CI issues that prevent new builds from being fully signed. We've seen this 3-4 times now. The builds aren't viewable or debuggable by people outside the org either.

We only actually use these images in tests, so this is just switching them to another image with a simpler build and test process that's debuggable by the community.

[cpanato]

some examples of recent failures

• https://github.com/sigstore/cosign/runs/6745077793?check_suite_focus=true (Bump github.com/hashicorp/go-secure-stdlib/parseutil from 0.1.5 to 0.1.6 #1958)

[dlorenc]

Merging to unblock things. We can revisit later if there's a better choice for these tests.

[mattmoor]

FWIW we've probably seen this dozens of times, it is just usually transient.

I filed this, which hasn't seen much traction: GoogleContainerTools/distroless#966

We are very intentional about promoting to :latest in github.com/distroless to avoid cases like this.