fix(release): sign and attest GitHub release assets directly#201

Merged

sunib merged 3 commits into

mainfrom

fix/sign-release-assets-scorecard

Jul 6, 2026

Commits on Jul 6, 2026

fix(release): sign and attest GitHub release assets directly

sunib
and
claude
committed
build: bake cosign into the ci-stage container image

sunib
and
claude
committed
fix(release): pin cosign-installer to the same version as the ci-image

sunib
and
claude
committed