From c1d270b8646551f2eeb1569616f98860b72aaf04 Mon Sep 17 00:00:00 2001 From: Amit Kumar Date: Thu, 23 Apr 2026 03:30:03 +0000 Subject: [PATCH] fix(ci): pin cosign to v2.6.3 (v3 changed sign-blob output defaults) cosign v3 now emits a Sigstore bundle by default; our explicit --output-signature + --output-certificate flags aren't compatible and the empty-bundle-path caused: 'create bundle file: open : no such file or directory'. v2.6.3 keeps the CLI we wrote for. Revisit v3 once we're ready to move to bundle-based attestations. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/release.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d29ff81..733ac59 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -140,7 +140,11 @@ jobs: - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 with: - cosign-release: 'v3.0.6' + # Pin v2.x — v3 changed sign-blob defaults to emit a Sigstore + # bundle alongside, and our --output-signature/--output-certificate + # flags aren't compatible with that new behaviour. Revisit v3 once + # we're ready to switch to bundle-based attestations. + cosign-release: 'v2.6.3' - name: Sign binaries run: |