ci: cosign keyless sigs, SBOM, provenance + fedora digest pin #7

Merged
s8n merged 3 commits from feat/sre-cosign-sbom-attestation into main 2026-05-06 13:47:28 +01:00
Showing only changes of commit b74ef5005d - Show all commits

View file

@ -1,3 +1,5 @@
# TODO: SHA-pin all uses: tags to commit SHAs (Agent 8 audit recommendation).
# Tracked separately so this PR can land without long web lookups.
name: Build veilor-os ISO
on: