fix(ci): cosign-installer has no v4 tag — pin to v3#164
Merged
Conversation
The v0.7.0 supply-chain job (sign + attest + SBOM) failed at 'Set up job': 'Unable to resolve action sigstore/cosign-installer@v4, unable to find version v4'. cosign-installer's latest major is v3; there is no v4. The rest of the release DID publish — NuGet 0.7.0, the Docker release tags, and the docs all shipped — but the image went out unsigned, with no provenance attestation and no SBOMs attached to the release, which is the whole point of the signed pipeline. Same dry-run blind spot as the Trivy fix: the supply-chain job is gated behind 'github.event_name == release || !dry_run', so the dispatch dry-run skips it and never resolves this action reference. (actions/attest-build-provenance@v4 is left as-is — it is a valid tag and the publish-nuget job already uses it successfully.) NuGet push already uses --skip-duplicate, so re-running the release for 0.7.0 after this lands will skip the already-published package and proceed to signing; the Docker tag promotion and docs deploy are idempotent overwrites. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What happened
The re-run of the v0.7.0 release got much further — the Trivy fix (#163) worked, both arches built, the gate passed, and NuGet 0.7.0, the Docker release tags, and the docs all published. But the final
Supply chain (sign + attest + SBOM)job failed at Set up job:So the image shipped unsigned, with no provenance attestation and no SBOMs attached to the release — which is the entire point of the signed pipeline (#117).
Root cause
sigstore/cosign-installer's latest major is v3; there is no v4. Same dry-run blind spot as the Trivy bug: the supply-chain job is gated behindgithub.event_name == 'release' || !inputs.dry_run, so the dispatch dry-run skips it and never resolves the action reference.actions/attest-build-provenance@v4is left as-is — it is a valid tag, and thepublish-nugetjob already uses it successfully.Fix
sigstore/cosign-installer@v4→@v3. One line.After merge — re-run is safe
--skip-duplicate, so the already-published 0.7.0 is skipped, not a hard failure.Recommend the same recovery as before: delete + recreate the v0.7.0 release from the fixed
develop.🤖 Generated with Claude Code