From 1b17fba19fb421b3d7c2ee073db6a487eb6d63b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc=20Sch=C3=A4fer?= Date: Sat, 16 May 2026 16:17:45 +0200 Subject: [PATCH] Upgrade cosign installer to v4.1.2 and pin cosign version Updated cosign installer to version 4.1.2 and specified cosign release version. --- .github/workflows/cicd.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/cicd.yml b/.github/workflows/cicd.yml index 7a9004ee8..d8f8385e3 100644 --- a/.github/workflows/cicd.yml +++ b/.github/workflows/cicd.yml @@ -415,7 +415,9 @@ jobs: - name: Install cosign # cosign is used to sign container images using keyless (OIDC) signing - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 + uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.2 + with: + cosign-release: v3.0.6 - name: Sign (GHCR, keyless) # Sign each GHCR image by digest using keyless (OIDC) signing via Sigstore/Rekor.