veilor-org/veilor-os
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

ci: pin sbom/cosign/attest actions to node20-safe versions

Browse source 
forgejo-runner v6.4.0 ships node20; floating tags @v0/@v3/@v2 now
resolve to actions whose runs.using=node24, which the runner cannot
exec. Pin to last node20-shipping release of each:

- anchore/sbom-action@v0.17.2
- sigstore/cosign-installer@v3.7.0
- actions/attest-build-provenance@v2.2.3

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
claude-veilor-bot 2026-05-06 13:57:49 +01:00 committed by s8n-ru
parent e801476ee3
commit 3db912d3cd
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
.github/workflows/build-iso.yml vendored
View file

@ -210,7 +210,8 @@ jobs:
- name: Install cosign - name: Install cosign
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
uses: sigstore/cosign-installer@v3 # Pinned to last v3 release confirmed node20.
uses: sigstore/cosign-installer@v3.7.0
- name: Sign ISO parts (keyless) - name: Sign ISO parts (keyless)
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
@ -224,7 +225,8 @@ jobs:
- name: Generate SBOM (SPDX) - name: Generate SBOM (SPDX)
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
uses: anchore/sbom-action@v0 # Pinned to last v0.17 release that ships node20.
uses: anchore/sbom-action@v0.17.2
with: with:
path: build/out path: build/out
format: spdx-json format: spdx-json
@ -232,7 +234,8 @@ jobs:
- name: Build provenance attestation - name: Build provenance attestation
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
uses: actions/attest-build-provenance@v2 # Pinned to last v2.2 release that ships node20.
uses: actions/attest-build-provenance@v2.2.3
with: with:
subject-path: 'build/out/*.iso.part-*' subject-path: 'build/out/*.iso.part-*'