From 702cf2861ff7684f25ae9c9366ff516f502565af Mon Sep 17 00:00:00 2001 From: Kobi Hikri Date: Wed, 15 Jul 2026 11:28:25 +0300 Subject: [PATCH] ci: pin sigstore/cosign-installer to a full commit SHA docker-publish.yml and docker-publish-v4.yml referenced this third-party action by the mutable @main branch inside the build job that holds packages: write + id-token: write and logs in to ghcr.io with GITHUB_TOKEN. Pinning to a full commit SHA (v4.1.2) removes the mutable-ref supply-chain exposure. The installed cosign version is unchanged (cosign-release input stays v2.2.3). --- .github/workflows/docker-publish-v4.yml | 2 +- .github/workflows/docker-publish.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker-publish-v4.yml b/.github/workflows/docker-publish-v4.yml index 8160e8a1..d49cd6b8 100644 --- a/.github/workflows/docker-publish-v4.yml +++ b/.github/workflows/docker-publish-v4.yml @@ -27,7 +27,7 @@ jobs: uses: actions/checkout@v5 - name: Install cosign - uses: sigstore/cosign-installer@main + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 with: cosign-release: 'v2.2.3' diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 29e137d0..e938c490 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -39,7 +39,7 @@ jobs: # Install the cosign tool (not used on PR, still installed) # https://github.com/sigstore/cosign-installer - name: Install cosign - uses: sigstore/cosign-installer@main + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 with: cosign-release: 'v2.2.3'