Allow empty inputs with release artifacts

[JeanChristopheMorinPerso]

Summary

Resolves #109

Some projects don't generate artifacts as part of their releases but would still like to have their source archives attached to releases signed (using release-signing-artifacts). This was previously not possible to do with this action because inputs was a required input.

With this pull request, it will be possible to not specify inputs and use release-signing-artifacts for releases:

permissions:
  contents: write

# ...

- uses: sigstore/gh-action-sigstore-python@v2.1.1
  with:
    # Only valid on release events
    release-signing-artifacts: true

Note that inputs is still required if release-signing-artifacts is not true and the event type is not release. In this case, the action will raise a descriptive error.

Release Note

• inputs was made optional when the event type is release and release-signing-artifacts is true.

Documentation

I adjusted the README to reflect the changes.

Tests

I'm not sure if I should add tests or not. I tested locally different scenarios and also ran the selftest workflow in my fork (https://github.com/JeanChristopheMorinPerso/gh-action-sigstore-python/actions/runs/7949857773), but I'm not sure how to properly test the release scenario without releasing a fork of the action...

[woodruffw]

Thanks @JeanChristopheMorinPerso! I'm reviewing now.

[woodruffw]

This looks great! One nitpick.

[woodruffw]

I'm not sure if I should add tests or not. I tested locally different scenarios and also ran the selftest workflow in my fork (https://github.com/JeanChristopheMorinPerso/gh-action-sigstore-python/actions/runs/7949857773), but I'm not sure how to properly test the release scenario without releasing a fork of the action...

Yeah, unfortunately tests here will probably be a PITA. I'm okay with skipping them for now; if we hit bugs on this path in the future, we'll investigate mocking up a release environment to test in.

[woodruffw]

Thanks @JeanChristopheMorinPerso!