Skip to content

Release 0.4.2: checkout v7, cache v6, cosign-installer v4 (cosign v3) #73

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
toshi0806 merged 1 commit into from
Jul 4, 2026
Merged

Release 0.4.2: checkout v7, cache v6, cosign-installer v4 (cosign v3) #73

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ jobs:

steps:
- name: Check out the repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- name: Set up Erlang/Elixir
uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
Expand All @@ -52,7 +52,7 @@ jobs:
elixir-version: ${{ matrix.elixir }}

- name: Cache mix dependencies
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
with:
path: deps
key: ${{ runner.os }}-mix-${{ hashFiles('**/mix.exs') }}
Expand Down Expand Up @@ -102,10 +102,10 @@ jobs:

steps:
- name: Check out the repository
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

- name: Install cosign
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4

- name: Download all build artifacts
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
Expand Down
6 changes: 4 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,8 +107,10 @@ with the release — each release's `SHA256SUMS` is signed with
maintainer-held key; the signature is bound to the release workflow's identity
via GitHub OIDC and logged to the public Sigstore transparency log).

This step is optional. If you have `cosign` installed and want the stronger
guarantee, download the bundle alongside the manifest and verify:
This step is optional. If you have **[cosign](https://github.com/sigstore/cosign) v3
or newer** installed and want the stronger guarantee, download the bundle
alongside the manifest and verify (releases from `0.4.2` on are signed with
cosign v3, whose Sigstore-bundle format needs cosign v3+ to verify):

@github-actions github-actions Bot Jul 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✨ [POSITIVE] cosign v3以降が必要である点、また0.4.2以降のリリースがcosign v3で署名されており検証にはv3+が必要である旨を明記したのは、下位互換性のないバンドル形式への移行に伴う利用者への影響を的確に伝える良い更新です。


```bash
curl -L -o SHA256SUMS https://github.com/smkwlab/tdig/releases/latest/download/SHA256SUMS
Expand Down
2 changes: 1 addition & 1 deletion mix.exs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ defmodule Tdig.MixProject do
def project do
[
app: :tdig,
version: "0.4.1",
version: "0.4.2",
name: "Tdig",
elixir: "~> 1.17",
start_permanent: Mix.env() == :prod,
Expand Down
Loading