Chris Lu 327e8b682c docker release: copy and sign the digest the run created, pin the rest ...

crane copy and the signature both resolved the tag, which another
publisher could move between the two steps. The index digest is read once,
right after it is created, and the Docker Hub copy and both signatures use
it. The manual latest rebuild gets the same treatment. The actions in these
jobs are pinned to commits, crane to v0.22.0 by checksum, and the sparse
checkout no longer keeps the token.

Claude-Session: https://claude.ai/code/session_01A5zMqzaUg1Snur4Yg8xJGa

2026-09-03 11:02:45 -07:00

..

actions

ci: pin the actions the signing jobs newly run by commit

2026-09-03 10:25:02 -07:00

workflows

docker release: copy and sign the digest the run created, pin the rest

2026-09-03 11:02:45 -07:00

dependabot.yml

ci: composite action that signs and verifies an image with cosign

2026-09-03 09:14:00 -07:00

FUNDING.yml

Update FUNDING.yml

2021-12-16 11:07:53 -08:00

ISSUE_TEMPLATE.md

move to https://github.com/seaweedfs/seaweedfs

2022-07-29 00:17:28 -07:00

pull_request_template.md

Modify AI review comments checklist in PR template

2026-02-09 08:58:35 -08:00