From b23765bebdb4a52fea961fe6046c54b49289b1d4 Mon Sep 17 00:00:00 2001 From: devitway Date: Thu, 19 Mar 2026 11:42:53 +0000 Subject: [PATCH] fix: update cosign-installer SHA to v3.8.0 --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index acee473..26117d4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -132,7 +132,7 @@ jobs: # ── Smoke test ────────────────────────────────────────────────────────── - name: Install cosign - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd1d5ad67616c25 # v3 + uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3 - name: Sign Docker images (keyless Sigstore) run: | @@ -240,7 +240,7 @@ jobs: output-file: nora-${{ github.ref_name }}.sbom.cdx.json - name: Install cosign - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd1d5ad67616c25 # v3 + uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3 - name: Sign binary with cosign (keyless Sigstore) run: cosign sign-blob --yes --output-signature nora-linux-amd64.sig --output-certificate nora-linux-amd64.pem ./nora-linux-amd64