krel-release-notes-validate workflow fails on deleted YAML files

[kernel-kun]

What happened:

The Yaml Lint Release Notes workflow (krel-release-notes-validate.yaml) fails when a PR deletes YAML files under releases/**/release-notes/.

The git diff --name-only command on line 91 includes deleted files in the changed files list. When the workflow subsequently tries to validate these files with krel release-notes validate --path-to-release-notes "$file", it fails because the files no longer exist on disk.

What you expected to happen:

The workflow should skip deleted files and only validate YAML files that exist in the PR's HEAD commit (added, copied, modified, or renamed).

How to reproduce it (as minimally and precisely as possible):

1. Create a PR that deletes a YAML file under releases/**/release-notes/
2. The Yaml Lint Release Notes check will fail

Example: https://github.com/kubernetes/sig-release/actions/runs/24441174040?pr=2994 - a failed check due to deleted map files

Anything else we need to know?:

The fix is to add --diff-filter=d (exclude deleted) to the git diff command:

- CHANGED_FILES=$(git diff --name-only ... -- releases/ | grep -E '\.ya?ml$' || true)
+ CHANGED_FILES=$(git diff --diff-filter=d --name-only ... -- releases/ | grep -E '\.ya?ml$' || true)

Environment:

• GitHub Actions workflow: .github/workflows/krel-release-notes-validate.yaml
• Workflow name: Yaml Lint Release Notes

[kernel-kun]

/assign

[kernel-kun]

Additionally, kubernetes/release#4357 switches cosign signing from the legacy .sig/.pem format to the new .sigstore.json bundle format. The krel-release-notes-validate workflow currently uses the old format for signature verification, which will break once a new krel release is cut with the bundle format.

I've updated the fix branch to also handle this: the workflow now tries the new --bundle format first (.sigstore.json), falling back to the legacy --certificate/--signature approach (.pem/.sig) for backward compatibility with older krel releases.