Chains creates attestation for non-successful TaskRuns

Expected Behavior

The Tekton Chains controller should only create TaskRun attestations if the TaskRun succeeds.

Actual Behavior

The controller creates TaskRun attestations regardless of the final state of the TaskRun.

Steps to Reproduce the Problem

It's easier to verify this behavior when the transparency log is enabled. The steps below assume this has been done.

1. Create a task, for example git-clone from the catalog:

curl 'https://raw.githubusercontent.com/tektoncd/catalog/main/task/git-clone/0.7/git-clone.yaml' | kubectl create -f -

2. Create a taskrun from the task. Provide incorrect parameter values to cause it to fail. For example provide a revision value that does not exist:

tkn task start git-clone --param url=https://github.com/tektoncd/chains --param revision=yolo --use-param-defaults --workspace name=output,emptyDir= --showlog

3. Verify the taskrun fails
4. Verify an attestation for the taskrun was created by verifying the taskrun contains a valid value for the annotation "chains.tekton.dev/transparency". This should not happen.

Additional Info

• Kubernetes version:

$ kubectl version --short
Flag --short has been deprecated, and will be removed in the future. The --short output will become the default.
Client Version: v1.24.2
Kustomize Version: v4.5.4
Server Version: v1.23.5+3afdacb

• Tekton Pipeline version:

$ tkn version
Client version: 0.21.0
Pipeline version: v0.33.2
Triggers version: v0.19.0