Repository navigation
Advance the cosign-installer pin, and gate the rule - #40
Merged
Merged
Conversation
sigstore/cosign-installer sat on the commit of v3.9.2 while v4.1.2 is current -- a major behind, in the workflow that signs releases. A stale pin is worse than a float, because it keeps a known-older release alive in the one job whose output people verify. This was found 2026-11-02 by the estate sweep and deliberately left alone at the time: the pin is in release.yml, and probaci#39 was open against that exact file. One writer per set of files. #39 is merged, so it lands now. The new step checks the shape of every reference offline, inside the existing test job, and fails below a floor of 5 workflow files. Proven red before this change and green after.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sigstore/cosign-installer@d58896d6a186…# v3.9.2@6f9f17788090…# v4.1.2A major behind, in the workflow that signs releases. A stale pin is worse than a float — it
keeps a known-older release alive, and here it does so in the one job whose output people verify.
Every other reference in this repository was already on the rule.
Why it waited
The estate sweep found this on 2026-11-02 and left it alone on purpose: the pin lives in
release.yml, and#39was open against that exact file (measured — line 65 on that branch, line38 on
main, and its file list includedrelease.yml). Two writers on one file is a guaranteedconflict.
#39is merged, so it lands now.The guard
The new step in the existing
testjob checks only the shape of each reference, so it is offline,needs no token, and adds no workflow. It counts the workflow files it read and fails below a floor
of 5. Proven red before the fix (1 off the rule) and green after (28 references, 0 off).