From 2dc2f354f3389e4daf640efbeaa342a1c42c430a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20Gonz=C3=A1lez=20Di=20Antonio?= Date: Sat, 19 Sep 2026 20:34:29 +0200 Subject: [PATCH] ci: pin sigstore/cosign-installer to v4.1.2 The action publishes exact tags only and never created a floating v4 tag (v3 exists, v4 does not), so @v4 fails to resolve and the release workflow cannot start. Its README pins the exact version; Dependabot keeps an exact pin current. Co-Authored-By: Claude Fable 5.1 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 88f3959..68bb9ae 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,7 +50,7 @@ jobs: GIT_VERSION=${{ github.ref_name }} GO_OS="linux" make build-dist - name: Install Cosign - uses: sigstore/cosign-installer@v4 + uses: sigstore/cosign-installer@v4.1.2 - name: Sign Linux binaries with Cosign (keyless) run: |