mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-11 09:00:45 +02:00
Chris Lu
fee3929a95
Keyless, by digest, with a verification pass against the calling workflow's own identity right after signing. Signatures use the .sig tag layout rather than the OCI-referrer bundle cosign 3 writes by default, since that is what the verifiers people run today read. Dependabot is pointed at the action so the cosign-installer pin keeps moving. Claude-Session: https://claude.ai/code/session_01A5zMqzaUg1Snur4Yg8xJGa
13 lines
233 B
YAML
13 lines
233 B
YAML
version: 2
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directories:
|
|
- "/"
|
|
- "/.github/actions/sign-image"
|
|
schedule:
|
|
interval: "weekly"
|
|
- package-ecosystem: gomod
|
|
directory: "/"
|
|
schedule:
|
|
interval: weekly
|