From 3bcd9e06b854ae0cdd155cce4e50ed89ef6ad8ed Mon Sep 17 00:00:00 2001
From: Asher Feldman <asher@edera.dev>
Date: Wed, 24 Jun 2026 10:32:37 -0700
Subject: [PATCH] chore(build-and-sign-image): upgrade cosign

---
 build-and-sign-image/action.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/build-and-sign-image/action.yml b/build-and-sign-image/action.yml
index d11071d..889c8c4 100644
--- a/build-and-sign-image/action.yml
+++ b/build-and-sign-image/action.yml
@@ -48,7 +48,7 @@ runs:
   using: composite
   steps:
     - name: 'Install cosign'
-      uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
+      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
     - name: 'Setup docker buildx'
       uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
@@ -228,7 +228,6 @@ runs:
         done
       env:
         DIGEST: '${{ steps.digest.outputs.digest }}'
-        COSIGN_EXPERIMENTAL: 'true'
 
     - name: 'Install syft'
       if: ${{ inputs.sbom == 'true' && inputs.push == 'true' }}
@@ -343,7 +342,6 @@ runs:
         TARGET: ${{ inputs.target }}
         SBOM_STRICT: ${{ inputs.sbom_strict }}
         GITHUB_ACTION_PATH: ${{ github.action_path }}
-        COSIGN_EXPERIMENTAL: 'true'
 
     - name: 'Cosign attest SBOM to all registries'
       if: ${{ inputs.sbom == 'true' && inputs.push == 'true' && steps.sbom.outputs.has_sbom == 'true' }}
@@ -370,7 +368,6 @@ runs:
         REPOSITORIES: ${{ inputs.repositories }}
         DIGEST: ${{ steps.sbom.outputs.digest }}
         COMPONENT: ${{ inputs.component }}
-        COSIGN_EXPERIMENTAL: 'true'
 
     - name: 'Upload SBOM as workflow artifact'
       if: ${{ inputs.sbom == 'true' && inputs.push == 'true' }}