build: update release workflow

- sigstore/cosign-installer to v3.0.1
- Put (exact) version comment behind all action references, while taking note
  this is an absolute insane way to manage versions.

Signed-off-by: Hidde Beydals <hidde@hhh.computer>
This commit is contained in:
Hidde Beydals 2023-03-08 18:59:01 +01:00
parent 47867cd80b
commit db67d2c4df
No known key found for this signature in database
GPG key ID: 979F380FC2341744
2 changed files with 18 additions and 16 deletions

View file

@ -65,6 +65,7 @@ signs:
certificate: '${artifact}.pem'
args:
- sign-blob
- "--yes"
- '--output-certificate=${certificate}'
- '--output-signature=${signature}'
- '${artifact}'
@ -175,6 +176,7 @@ docker_signs:
- COSIGN_EXPERIMENTAL=1
args:
- sign
- "--yes"
- '${artifact}'
artifacts: all
output: true