From dcbb9338cf1eff734664aed2f893f19d78e44aca Mon Sep 17 00:00:00 2001 From: null-paorodrigues Date: Mon, 7 Sep 2026 12:31:44 -0300 Subject: [PATCH] chore: pin cosign-installer by sha with explicit cosign version the composite installed the action by mutable tag and relied on the installer default cosign (drifts with installer releases); pinned to the v4.1.2 commit sha with cosign v3.1.3 explicit (latest stable, no known advisories) --- .github/actions/sign-image/action.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/actions/sign-image/action.yml b/.github/actions/sign-image/action.yml index 9aef124..cb3900a 100644 --- a/.github/actions/sign-image/action.yml +++ b/.github/actions/sign-image/action.yml @@ -31,7 +31,11 @@ runs: registry-type: public - name: Install cosign - uses: sigstore/cosign-installer@v4.1.2 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + with: + # Explicit and pinned: the installer's default drifts with its own + # releases; v3.1.3 is the latest stable with no known advisories. + cosign-release: 'v3.1.3' - name: Sign image shell: bash