build(deps): bump sigstore/cosign-installer from 3.9.1 to 4.1.2 - #271
Merged
richardmhope merged 1 commit intoJul 22, 2026
Merged
Conversation
dependabot
Bot
added
dependencies
![icebergai-review-bot[bot]](https://avatars.githubusercontent.com/u/290878036?s=60&v=4){kind=small}
There was a problem hiding this comment.
IcebergAutoReview
Verdict: approve
The major upgrade is compatible with the repository’s release workflow. The PR changes only the cosign installer’s immutable SHA, correctly identifying the signed v4.1.2 release, which installs Cosign v3.0.6. The workflow signs an OCI image digest with cosign sign --yes; the documented v3 --bundle breaking change applies to sign-blob, not this command.
Findings
- No blocking findings.
Validation
- Inspected the complete
main...HEADdiff and commit ancestry; found one expected workflow-line change and no unrelated files. - Ran
git diff --check main...HEAD; no whitespace errors. - Verified the new full commit SHA corresponds to the signed upstream v4.1.2 release and that its action manifest defaults to Cosign v3.0.6.
- Reviewed all repository cosign usages and the release workflow context; no
sign-blobusage or removed inputs require migration. - Confirmed full-SHA action pinning is preserved and current CI includes blocking workflow syntax and security audits.
Residual risks / optional notes
- Normal PR CI does not execute the push/signing branch because the release workflow skips it during default dry runs. Compatibility is nevertheless supported by upstream’s current OCI image-signing guidance; an unchecked manual dry run remains the end-to-end validation path.
Automated review by Codex cf073db44f55 using IcebergAutoReview.
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.9.1 to 4.1.2. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@398d4b0...6f9f177) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/sigstore/cosign-installer-4.1.2
branch
from
July 22, 2026 00:37
cf073db to
3a0bd75
Compare
Collaborator
|
·@·d·ependabot m·erge Generated by Claude Code |
There was a problem hiding this comment.
IcebergAutoReview
Verdict: approve
The rebased PR preserves the exact previously approved cosign upgrade. The apparent 21-file follow-up delta is merged base-branch work; main...HEAD contains only the intended immutable action-pin update.
Findings
- No blocking findings.
Validation
- Compared cf073db..HEAD and reconstructed ancestry: HEAD is one commit ahead of current main.
- Confirmed the old and new PR commits have identical stable patch IDs.
- Inspected main...HEAD: one line changes in .github/workflows/release.yml, from cosign-installer v3.9.1 to v4.1.2.
- Reviewed affected release workflow context and all repository cosign usages; signing remains
cosign sign --yeswith nosign-blobcompatibility concern. - Ran
git diff --check main...HEAD; no whitespace errors. - Relied on the stated fully green current-head CI for broad validation; no local suites rerun.
Residual risks / optional notes
- The push/signing path is not exercised by ordinary dry-run CI. Its end-to-end behavior remains dependent on a real release or manually authorized non-dry run.
Automated review by Codex 3a0bd75514d7 using IcebergAutoReview.
richardmhope
deleted the
dependabot/github_actions/sigstore/cosign-installer-4.1.2
branch
July 22, 2026 00:45
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps sigstore/cosign-installer from 3.9.1 to 4.1.2.
Release notes
Sourced from sigstore/cosign-installer's releases.
... (truncated)
Commits
6f9f177Bump cosign to 3.0.6 (#232)b5e753aBump actions/github-script from 8.0.0 to 9.0.0 (#230)115e4ceBump actions/setup-go from 6.3.0 to 6.4.0 (#226)cad07c2chore: update default cosign-release to v3.0.5 (#223)ba7bc0afix: add retry to curl downloads for transient network failures (#210)5a292e1Bump cosign to 3.0.5 (#220)351ea76Bump actions/checkout from 6.0.1 to 6.0.2 (#217)c17565ftest with go 1.26 too (#221)a6fdd19Bump actions/setup-go from 6.1.0 to 6.3.0 (#218)430b6a7docs: fix registry from gcr.io to ghcr.io (#213)