2nd version with apko and distroless image build

in this example, I am trying to
-- build an distroless image using apko tool,
-- and then sign it using cosign, verify it,
-- and then verify it against a cluster policy using kyverno cli,
-- then deploy it to a k3s cluster.

1st version using docker buildx

-- build image and push to Github
-- sign image using cosign
-- verify image attestation using 'cosign verify'
-- install kyverno cli
-- dry run policy with kyverno cli
-- create k3s cluster
-- install kyverno chart
-- deploy image to cluster