From f93593c4e55e5c98eb58a1dc68724e2b3fecd552 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 7 Mar 2023 10:53:41 +0100 Subject: [PATCH] :arrow_up: Bump sigstore/cosign-installer from 2.8.1 to 3.0.1 (#244) Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Marco Franssen --- .github/workflows/ci.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 9a651994..d7902de7 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -81,9 +81,9 @@ jobs: cache: true - name: Install cosign - uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # ratchet:sigstore/cosign-installer@v2.8.1 + uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # ratchet:sigstore/cosign-installer@v3.0.1 with: - cosign-release: 'v1.13.1' + cosign-release: 'v2.0.0' - name: Install Syft uses: anchore/sbom-action/download-syft@07978da4bdb4faa726e52dfc6b1bed63d4b56479 # ratchet:anchore/sbom-action/download-syft@v0.13.3 @@ -154,9 +154,9 @@ jobs: steps: - name: Install cosign - uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # ratchet:sigstore/cosign-installer@v2.8.1 + uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # ratchet:sigstore/cosign-installer@v3.0.1 with: - cosign-release: 'v1.13.1' + cosign-release: 'v2.0.0' - name: Install Syft uses: anchore/sbom-action/download-syft@07978da4bdb4faa726e52dfc6b1bed63d4b56479 # ratchet:anchore/sbom-action/download-syft@v0.13.3 @@ -203,9 +203,9 @@ jobs: GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" - name: Install cosign - uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # ratchet:sigstore/cosign-installer@v2.8.1 + uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # ratchet:sigstore/cosign-installer@v3.0.1 with: - cosign-release: 'v1.13.1' + cosign-release: 'v2.0.0' - name: Sign provenance run: | @@ -239,9 +239,9 @@ jobs: steps: - name: Install cosign - uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # ratchet:sigstore/cosign-installer@v2.8.1 + uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # ratchet:sigstore/cosign-installer@v3.0.1 with: - cosign-release: 'v1.13.1' + cosign-release: 'v2.0.0' - name: Generate provenance for ${{ matrix.repo }} uses: philips-labs/slsa-provenance-action@752766b8a3b1ebd09d599e163eeec8fa39e677aa # ratchet:philips-labs/slsa-provenance-action@v0.8.0