Update sigstore/cosign-installer action to v3.7.0 #5
Conversation
Reviewer's Guide by SourceryThis PR updates the sigstore/cosign-installer GitHub Action from v3.5.0 to v3.7.0 in the Docker publish workflow. The update includes the latest cosign v2.4.1 release and various dependency updates in the installer action itself. No diagrams generated as the changes look simple and do not need a visual representation. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
WalkthroughThe pull request updates the Docker publishing workflow configuration in the GitHub Actions setup. It specifically replaces the version of the Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Outside diff range and nitpick comments (1)
.github/workflows/docker-publish.yml (1)
Line range hint
1-93: Consider security enhancements for the workflowWhile reviewing the workflow, I noticed some security-related suggestions:
- The workflow has appropriate permission scoping, which is good security practice.
- The workflow correctly uses commit SHA pins for all GitHub Actions, which prevents supply chain attacks.
- The signing step correctly uses an intermediate environment variable for security hardening.
However, consider these additional security enhancements:
- Add SLSA provenance generation for better supply chain security
- Enable cosign's keyless signing verification in your consumers
Would you like me to provide example configurations for these security enhancements?
| with: | ||
| cosign-release: 'v2.2.4' |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Update cosign-release to v2.4.1
The workflow is using cosign v2.2.4, but the PR objectives mention that v3.7.0 of the installer supports cosign v2.4.1. Consider updating to the latest supported version.
with:
- cosign-release: 'v2.2.4'
+ cosign-release: 'v2.4.1'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| with: | |
| cosign-release: 'v2.2.4' | |
| with: | |
| cosign-release: 'v2.4.1' |
| @@ -41,7 +41,7 @@ jobs: | |||
| # https://github.com/sigstore/cosign-installer | |||
| - name: Install cosign | |||
| if: github.event_name != 'pull_request' | |||
| uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0 | |||
| uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0 | |||
There was a problem hiding this comment.
💡 Codebase verification
Incorrect commit hash and outdated cosign-release version
The workflow file has two issues that need attention:
- The commit hash
dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537dadoes not match the official v3.7.0 tag (1aa8e0f2454b781fbf0fbf306a4c9533a0c57409) - The
cosign-releaseis pinned to v2.2.4 while the PR objectives mention updating to v2.4.1
Please update:
- Use the correct commit hash for v3.7.0:
1aa8e0f2454b781fbf0fbf306a4c9533a0c57409 - Update the
cosign-releaseinput tov2.4.1
🔗 Analysis chain
LGTM! Verified cosign-installer version.
The commit hash dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da correctly corresponds to v3.7.0 of the cosign-installer action.
The initial verification shows a mismatch between the commit hash in the workflow and the one from the GitHub API. Let's gather more context about cosign usage in the workflows to provide a comprehensive response.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Verify the commit hash matches the v3.7.0 tag
gh api repos/sigstore/cosign-installer/git/refs/tags/v3.7.0 --jq .object.sha
Length of output: 119
Script:
#!/bin/bash
# Let's verify the actual commit hash used in the workflow
rg "cosign-installer@" -A 2
# Also check if there are any other cosign-related actions in use
rg "cosign" .github/workflows/
Length of output: 803
This PR contains the following updates:
v3.5.0->v3.7.0Release Notes
sigstore/cosign-installer (sigstore/cosign-installer)
v3.7.0Compare Source
What's Changed
Full Changelog: sigstore/cosign-installer@v3.6.0...v3.7.0
v3.6.0Compare Source
What's Changed
Full Changelog: sigstore/cosign-installer@v3...v3.6.0
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.