Pin sigstore/cosign-installer instead of tracking @main (all 15 operators)

[whg517]

What

Every operator's release workflow tracks the action's default branch:

- name: Setup Cosign
  uses: sigstore/cosign-installer@main

All 15 repositories. It is the only unpinned action in these workflows —
every other one is pinned to a release:

actions/checkout@v6            docker/login-action@v4
actions/setup-go@v6            docker/setup-buildx-action@v4
actions/setup-python@v6        docker/setup-qemu-action@v4
azure/setup-helm@v5            golangci/golangci-lint-action@v9
helm/chart-testing-action@v2.8.0   helm/kind-action@v1.14.0
sigstore/cosign-installer@main     ← the exception

Why it matters — a concrete example

The signature storage format changed underneath the release process without
anyone noticing.

Older cosign published signatures as a separate sha256-<digest>.sig tag.
Current cosign attaches them as OCI referrers instead:

GET /v2/zncdatadev/doris-operator/referrers/sha256:0cad44c0...
→ application/vnd.dev.sigstore.bundle.v0.3+json

commons-operator's registry still shows nine .sig tags, the newest dated
2025-10-06. That date is not when signing stopped — it is when the tooling
silently switched schemes, because @main picked up a new major version between
releases.

Signing works correctly today; all 15 0.4.0 images pass cosign verify. But
the behaviour change was invisible until someone went looking, and it did briefly
lead to a false "signatures are missing" report during 0.4.0 verification.

The general risk: an unpinned action in a release path means a third party's
merge to main can alter what a tagged, signed release produces — with no diff
in this org to review, and no way to reproduce an old release's exact behaviour.

Suggested change

Pin like everything else. Latest release is v4.1.2 (2026-05-07):

- name: Setup Cosign
  uses: sigstore/cosign-installer@v4

Worth applying across all 15 repos in one pass, alongside dependabot coverage so
upgrades arrive as reviewable PRs rather than silently.

Context

Found while verifying 0.4.0 release artifacts. Not a defect in the current
release — the images are signed and verify correctly.

🤖 Generated with Claude Code

[whg517]

PRs opened across all 15 repositories — one line each, @main → @v4:

Repo	PR
commons-operator	#302
listener-operator	#342
secret-operator	#367
zookeeper-operator	#373
airflow-operator	#196
doris-operator	#112
spark-k8s-operator	#280
superset-operator	#277
hdfs-operator	#325
hive-operator	#351
kafka-operator	#304
nifi-operator	#98
hbase-operator	#266
trino-operator	#388
dolphinscheduler-operator	#266

Each diff is a single line in .github/workflows/release.yml; workflow YAML validated in every repo. cosign-installer appears only in release.yml — no other workflow references it.

Not covered by these PRs, worth deciding separately: adding sigstore/cosign-installer to dependabot so future major versions arrive as reviewable PRs rather than needing another sweep.

[whg517]

Correction to my last comment — the dependabot suggestion is unnecessary, and the reason is itself the missing piece of this story.

All 15 repos already have package-ecosystem: "github-actions" configured on a weekly schedule:

- package-ecosystem: "github-actions"
  directory: "/"
  schedule:
    interval: "weekly"

So why did dependabot never flag cosign-installer? Because @main is a branch reference, not a version — there is nothing for dependabot to bump. It silently skipped this action while dutifully keeping the other ten current. That is exactly why this one drifted alone.

Pinning to @v4 brings it back under dependabot's coverage automatically. No config change needed; future major versions will arrive as reviewable PRs on their own.

Which also makes the general lesson sharper than "pin your actions": an unpinned action is invisible to the tooling that would otherwise keep it honest. The gap was not that nobody was watching — it was that the watcher had nothing to watch.

[whg517]

Done — all 15 PRs merged and verified on main:

• sigstore/cosign-installer@v4 in every release.yml (15/15)
• github-actions ecosystem present in every dependabot.yml (15/15)

The second item was not in the original scope. spark-k8s-operator turned out to be the only repo without package-ecosystem: "github-actions" — configured for gomod and docker only. That explains an anomaly noticed earlier in the 0.4.0 work: its golangci-lint-action sat on v7/v8 while every other repo had moved to v9. Nothing was proposing the bumps. Added alongside the pin, since pinning only helps if something keeps it current.

Closing.