From 36c70ff852704d50b38397fab01b750c080f7089 Mon Sep 17 00:00:00 2001 From: Bernhard Windisch Date: Tue, 21 Jul 2026 18:41:31 +0200 Subject: [PATCH] =?UTF-8?q?fix(ci):=20cosign-installer=20has=20no=20v4=20t?= =?UTF-8?q?ag=20=E2=80=94=20pin=20to=20v3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The v0.7.0 supply-chain job (sign + attest + SBOM) failed at 'Set up job': 'Unable to resolve action sigstore/cosign-installer@v4, unable to find version v4'. cosign-installer's latest major is v3; there is no v4. The rest of the release DID publish — NuGet 0.7.0, the Docker release tags, and the docs all shipped — but the image went out unsigned, with no provenance attestation and no SBOMs attached to the release, which is the whole point of the signed pipeline. Same dry-run blind spot as the Trivy fix: the supply-chain job is gated behind 'github.event_name == release || !dry_run', so the dispatch dry-run skips it and never resolves this action reference. (actions/attest-build-provenance@v4 is left as-is — it is a valid tag and the publish-nuget job already uses it successfully.) NuGet push already uses --skip-duplicate, so re-running the release for 0.7.0 after this lands will skip the already-published package and proceed to signing; the Docker tag promotion and docs deploy are idempotent overwrites. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/cd-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cd-release.yml b/.github/workflows/cd-release.yml index cdda5180..5a9f2e49 100644 --- a/.github/workflows/cd-release.yml +++ b/.github/workflows/cd-release.yml @@ -551,7 +551,7 @@ jobs: echo "DIGEST=$DIGEST" >> $GITHUB_OUTPUT - name: Install cosign - uses: sigstore/cosign-installer@v4 + uses: sigstore/cosign-installer@v3 # Keyless (Fulcio/Rekor): the signature is bound to this workflow # run's OIDC identity — no long-lived signing key to manage or