Pin cosign-installer to v1

We now have tags available in the cosign-installer, which allows us to pin the latest release via `v1`. Signed-off-by: Sascha Grunert <[email protected]>
securego · Jun 17, 2022 · 721143d · 721143d
1 parent a9b0ef0
commit 721143d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -10,7 +10,7 @@ jobs:
       GO111MODULE: on
       ACTIONS_ALLOW_UNSECURE_COMMANDS: true
     steps:
-      - name: Checkout Source 
+      - name: Checkout Source
         uses: actions/checkout@v3
       - name: Unshallow
         run: git fetch --prune --unshallow
@@ -19,7 +19,7 @@ jobs:
         with:
           go-version: 1.18
       - name: Install Cosign
-        uses: sigstore/cosign-installer@main
+        uses: sigstore/cosign-installer@v1
         with:
           cosign-release: 'v1.6.0'
       - name: Store Cosign private key in a file