From 9683e765e79221c7d93b43d90d7a26d27d14d979 Mon Sep 17 00:00:00 2001
From: Jon Gallant <jong@microsoft.com>
Date: Sat, 18 Jul 2026 11:13:05 -0700
Subject: [PATCH] fix(release): drop cosign --oidc-issuer flag that breaks
 signing

Newer cosign (installed unpinned by cosign-installer) auto-loads a signing config and rejects explicitly-set service URLs, so sign-blob failed with 'cannot specify service URLs and use signing config' and no release was published. The ambient GitHub Actions OIDC and the signing config supply the issuer, so the flag is redundant. Remove it to restore keyless signing.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 524cf702-8922-4cfd-b23f-4069b734e09b
---
 .goreleaser.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.goreleaser.yml b/.goreleaser.yml
index d63fc05b..70ac099a 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -40,7 +40,6 @@ signs:
     args:
       - "sign-blob"
       - "--yes"
-      - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "--output-signature=${signature}"
       - "--output-certificate=${certificate}"
       - "${artifact}"