ci: fix cosign-installer version annotation to real tag v4.1.2#76
Merged
Conversation
Renovate resolves the current version from the pin comment, but sigstore/cosign-installer has no floating v4 tag, so the digest-update lookup failed on every run (WARNING on the Dependency Dashboard). Digest 6f9f177 is the v4.1.2 release; annotate it as such. Comment-only change — the executed workflow is unchanged. Resolves #75 Claude-Session: https://claude.ai/code/session_01A3UeXMSewEQ3dVRAKC95YR
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| - name: Install cosign | ||
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4 | ||
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 |
Contributor
There was a problem hiding this comment.
✨ [POSITIVE] 実在するタグ v4.1.2 に注釈を修正することで、Renovate の digest 更新 lookup 失敗を解消できる適切な対応です。SHA ピン留めを維持したままセキュリティを損なわずに WARNING を解決しています。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
Dependency Dashboard (#69) の Renovate WARNING（
Could not determine new digest for update (github-tags package sigstore/cosign-installer)）の修正。原因と対応
# v4だったが、sigstore/cosign-installerに浮動タグv4は存在しない（git/ref/tags/v4は 404）6f9f177…の実体はv4.1.2（tags API で確認済み）なので、注釈を# v4.1.2に修正検証について
コメントのみの変更で、実行される workflow（digest 参照）は不変。release workflow の実走検証（実タグ）は不要で、Renovate 側の効果は次回実行時に dashboard #69 の WARNING が消えることで確認する。
Resolves #75
https://claude.ai/code/session_01A3UeXMSewEQ3dVRAKC95YR