Skip to content

Release v2.2.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Sep 02:42
· 21 commits to main since this release
v2.2.1
850ad34
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release v2.2.1

Changes

  • chore: release 2.2.1 (#50)
  • Merge pull request #49: cosign 3 for release signing; replace the dead key-based path
  • docs+build: correct cosign compatibility from the smoke-test evidence
  • Merge branch 'worktree-agent-a9166afc4e236f517' into ci/cosign-v3
  • docs: document keyless image verification; drop key-based signing guides
  • build: replace dead key-based cosign targets with keyless docker-verify
  • fix(ci): attest the SBOM as spdxjson, not spdx
  • ci: sign releases with cosign 3.1.3, verify before publishing, add a smoke test

Images

  • rainmanjam/headwater:2.2.1
  • ghcr.io/rainmanjam/headwater:2.2.1
  • Digest: sha256:2a551226e7335c05b7ac249e1965acaa6e6e9fb0973f5b2b12aef89a104d09f9

Verify the signature

cosign verify \
  --certificate-identity-regexp 'https://github.com/rainmanjam/headwater/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/rainmanjam/headwater@sha256:2a551226e7335c05b7ac249e1965acaa6e6e9fb0973f5b2b12aef89a104d09f9
Assets 3
Loading