Testing for the published repository

[jku]

Current publish workflow tests the repository deployed to GH pages (and #45 will not deploy to GCS if there is a failure). The repository in GH Pages is also periodically tested.

We should also test the final published repository. I'm not sure how much we can reuse test.yml:

• in workflow_call case we want to test either Pages (the testing repo) or GCS (published repo) depending on what stage of publish we are in: logically the published URL(s) should be inputs that the caller (publish workflow) can provide
• in schedule case we kind of want to test both Pages and GCS -- but you can't provide inputs in schedule events. it's a bit annoying if we need to add two new workflows just to call test workflow with correct inputs...

Maybe for the above reason and to make reporting (filed issues) easier to understand, there should be two separate test workflows: test (what we have now) and test-gcs (sigstore specific).

[jku]

• custom-test.yml should be modified so the metadata-URL-to-test is an input
• Then new test-gcs.yml workflow would:
  • use theupdateframework/tuf-on-ci/actions/test-repository with the GCS metadata urls to run the generic TUF tests (this is useful since this test confirms that repository contains the correct metadata (as defined by publish branch))
  • use ./.github/workflows/custom-test.yml with the GCS metadata urls to run the sigstore tests
• test-gcs.yml would be invoked by
  • schedule
  • dispatch from publish
  • manual dispatch would be nice as well