From 083b2ab32905964f04bbf00945db522036c41676 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bartosz=20Pacho=C5=82ek?= Date: Mon, 28 Sep 2026 02:25:38 +0200 Subject: [PATCH] CI: pin sigstore/cosign-installer to v4.1.2; it has no v4 tag The v0.6.0 tag's docker and release jobs failed in Set up job: 'Unable to resolve action sigstore/cosign-installer@v4, unable to find version v4'. cosign-installer publishes full version tags only since v4, and only tag-only jobs use it, so the bump's PR checks never resolved it. Every other action ref in the workflows resolves. AGENTS.md notes the exception and to check that a ref exists before bumping it. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 3 ++- .github/workflows/release.yml | 3 ++- AGENTS.md | 7 +++++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 30a29b5..5c6c58e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -334,7 +334,8 @@ jobs: - name: Install Cosign if: startsWith(github.ref, 'refs/tags/v') - uses: sigstore/cosign-installer@v4 + # A full version: cosign-installer publishes no major tag (no v4). + uses: sigstore/cosign-installer@v4.1.2 with: # Match the pin in release.yml so both signing surfaces # (docker image here, checksums.txt in release.yml) use the diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f4b48fe..f1d089b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -87,7 +87,8 @@ jobs: uses: anchore/sbom-action/download-syft@v0 - name: Install Cosign for checksum signing - uses: sigstore/cosign-installer@v4 + # A full version: cosign-installer publishes no major tag (no v4). + uses: sigstore/cosign-installer@v4.1.2 with: # Pin cosign itself, not just the installer action. The rest # of the supply-chain tooling pins tightly (golangci-lint diff --git a/AGENTS.md b/AGENTS.md index 5cc353e..56a8e9c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -295,8 +295,11 @@ CI is GitHub Actions: | [fuzz.yml](.github/workflows/fuzz.yml) | Nightly at 04:00 UTC: every fuzz target. | | [mutation.yml](.github/workflows/mutation.yml) | Weekly on Sunday at 03:00 UTC: the full gremlins run. | -Actions are pinned by major version (`@v7`), and Dependabot proposes the -bumps. +Actions are pinned by major version (`@v7`), except +`sigstore/cosign-installer`, which publishes no major tags and is pinned to a +release (`@v4.1.2`); Dependabot proposes the bumps. A tag-only job is the +first to use an action's new ref, so check that the ref exists before bumping +one. PRs run, in this order: