From ceeb94e7f53103cccc63b8ef1e586db6b3ab8712 Mon Sep 17 00:00:00 2001 From: Toshihiko SHIMOKAWA Date: Sun, 5 Jul 2026 15:13:26 +0900 Subject: [PATCH] ci: fix cosign-installer version annotation to real tag v4.1.2 (#75) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Renovate resolves the current version from the pin comment, but sigstore/cosign-installer has no floating v4 tag, so the digest-update lookup failed on every run (WARNING on the Dependency Dashboard). Digest 6f9f177 is the v4.1.2 release; annotate it as such. Comment-only change — the executed workflow is unchanged. Resolves #75 Claude-Session: https://claude.ai/code/session_01A3UeXMSewEQ3dVRAKC95YR --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ec854d8..ddbe99a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -105,7 +105,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - name: Install cosign - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Download all build artifacts uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4