2 Commits

Include renames

Author	SHA1	Message	Date
Chris Lu	0d3aebbcbe	ci: pin the actions the signing jobs newly run by commit ... These run with registry credentials and the OIDC token that signs under the repository's identity, so a retargeted tag upstream must not be able to reach them. Claude-Session: https://claude.ai/code/session_01A5zMqzaUg1Snur4Yg8xJGa	2026-09-03 10:25:02 -07:00
Chris Lu	fee3929a95	ci: composite action that signs and verifies an image with cosign ... Keyless, by digest, with a verification pass against the calling workflow's own identity right after signing. Signatures use the .sig tag layout rather than the OCI-referrer bundle cosign 3 writes by default, since that is what the verifiers people run today read. Dependabot is pointed at the action so the cosign-installer pin keeps moving. Claude-Session: https://claude.ai/code/session_01A5zMqzaUg1Snur4Yg8xJGa	2026-09-03 09:14:00 -07:00