From 81ad7ad30552e22e658dd1628f856017c489bfc3 Mon Sep 17 00:00:00 2001 From: whg517 Date: Sun, 23 Aug 2026 13:59:42 +0800 Subject: [PATCH] ci: pin sigstore/cosign-installer to v4 This was the only unpinned action in the release workflow - every other one already tracks a release tag. Tracking @main means a third party merging to their default branch can change what a tagged, signed release produces, with no diff to review on our side and no way to reproduce an older release. That is not hypothetical here: the signature storage format changed underneath us this way. Older cosign published signatures as a separate sha256-.sig tag; current cosign attaches them as OCI referrers instead. The switch happened silently when @main picked up a new major version, and only surfaced during 0.4.0 verification. Signing itself is fine - all 0.4.0 images verify. This just makes the next such change a deliberate upgrade. Co-Authored-By: Claude Opus 5 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a237c50..3382ea7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -161,7 +161,7 @@ jobs: uses: actions/checkout@v6 - name: Setup Cosign - uses: sigstore/cosign-installer@main + uses: sigstore/cosign-installer@v4 - name: Set up QEMU uses: docker/setup-qemu-action@v4