Skip to content

v0.2.1

Latest
Marketplace
Latest
Marketplace

Choose a tag to compare

View all tags
@skil-lock skil-lock released this 12 Jun 16:15
v0.2.1
6c2fd7c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v0.2.1

  • New input: verify-signature — when enabled, the Action cosign-verifies checksums.txt against the release workflow's OIDC identity before trusting any downloaded binary (keyless, no key management). Requires a pin-binary of v0.2.0 or later; warns and falls back to checksum-only verification otherwise.
  • Installs cosign via SHA-pinned sigstore/cosign-installer (GitHub runners no longer ship cosign).
  • Docs: usage examples bumped to pin-binary: v0.2.1.

Full CLI changes in skil-lock v0.2.1.

Assets 2
Loading