brandon/ci-plugins
1
0
Fork 0
Code Issues 1 Pull requests 2 Projects Releases Packages Wiki Activity Actions

docs: record cosign signer v0.1.2 digest #22

Open
brandon wants to merge 2 commits from docs/record-cosign-v0-1-2 into main
pull from: docs/record-cosign-v0-1-2
merge into: brandon:main
Conversation 2 Commits 2 Files changed 1 +1
brandon commented 2026-08-27 22:17:41 +00:00
Owner
Copy link

Records the published signer digest used for private-registry authentication.

Records the published signer digest used for private-registry authentication.
docs: record cosign signer v0.1.2 digest
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Details
806c5f4f9a
brandon commented 2026-10-16 13:17:05 +00:00
Author
Owner
Copy link

Triage (2026-10-16): I checked this against main at d7b7c8a, which includes the notify-on-push-failure fix (#52). Left open, not rebased. This is an operator-authored branch, so I won't force-push it.

  • Still relevant: main records no cosign-sign digest after v0.1.1. The v0.1.2 index digest in this PR, sha256:e7407fdb…88c29b9, still resolves from git.nastoupil.org/brandon/cosign-sign:v0.1.2 (checked anonymously today).
  • Partly stale: the catalog-row hunk (v0.1.1 -> v0.1.2) is obsolete. main already lists cosign-sign at v0.1.4.
  • Rebase conflict: README.md, in the catalog table only. To resolve, keep main's catalog rows unchanged and keep only the new digest-table row.
  • Gap this PR doesn't cover: v0.1.3 (sha256:0917ff1b…) and v0.1.4 (sha256:cd447f32…) are published but not recorded either. My recommendation: rebase this branch (or replace it) so it records the v0.1.2–v0.1.4 rows together, after you verify their signatures/scan the same way the original PR did.

Risk: R2 (supply-chain digest record that consumers pin against). Reuse: the existing README digest-table convention.

Triage (2026-10-16): I checked this against `main` at d7b7c8a, which includes the notify-on-push-failure fix (#52). **Left open, not rebased.** This is an operator-authored branch, so I won't force-push it. - **Still relevant:** `main` records no `cosign-sign` digest after `v0.1.1`. The `v0.1.2` index digest in this PR, `sha256:e7407fdb…88c29b9`, still resolves from `git.nastoupil.org/brandon/cosign-sign:v0.1.2` (checked anonymously today). - **Partly stale:** the catalog-row hunk (`v0.1.1` -> `v0.1.2`) is obsolete. `main` already lists `cosign-sign` at `v0.1.4`. - **Rebase conflict:** README.md, in the catalog table only. To resolve, keep `main`'s catalog rows unchanged and keep only the new digest-table row. - **Gap this PR doesn't cover:** `v0.1.3` (`sha256:0917ff1b…`) and `v0.1.4` (`sha256:cd447f32…`) are published but not recorded either. My recommendation: rebase this branch (or replace it) so it records the `v0.1.2`–`v0.1.4` rows together, after you verify their signatures/scan the same way the original PR did. Risk: R2 (supply-chain digest record that consumers pin against). Reuse: the existing README digest-table convention.
Merge origin/main into docs/record-cosign-v0-1-2
All checks were successful
ci/woodpecker/pr/pr-review Pipeline was successful
Details
ci/woodpecker/pr/ci Pipeline was successful
Details
ab08da5198 
Resolve the README conflict: the catalog keeps main's newer cosign-sign
v0.1.4 row (it supersedes this PR's v0.1.1 -> v0.1.2 bump), and the digest
table keeps this PR's cosign-sign v0.1.2 record after v0.1.1, alongside
every row main added.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude-review commented 2026-10-16 20:59:31 +00:00
First-time contributor
Copy link

This is a simple documentation update with no actionable findings:

Summary: Adds a new row to the README.md table documenting version v0.1.2 of the cosign-sign plugin with its SHA256 digest and release date.

Findings: None. The change is straightforward - it adds a table entry for a new plugin version with no code modifications, security concerns, or issues detected.

This is a simple documentation update with no actionable findings: **Summary:** Adds a new row to the README.md table documenting version `v0.1.2` of the `cosign-sign` plugin with its SHA256 digest and release date. **Findings:** None. The change is straightforward - it adds a table entry for a new plugin version with no code modifications, security concerns, or issues detected. <!-- claude-review: commit=ab08da5198985e98662cd774cb23d52eb872f4de -->
All checks were successful
ci/woodpecker/pr/pr-review Pipeline was successful
Details
ci/woodpecker/pr/ci Pipeline was successful
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin docs/record-cosign-v0-1-2:docs/record-cosign-v0-1-2
git switch docs/record-cosign-v0-1-2

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff docs/record-cosign-v0-1-2
git switch docs/record-cosign-v0-1-2
git rebase main
git switch main
git merge --ff-only docs/record-cosign-v0-1-2
git switch docs/record-cosign-v0-1-2
git rebase main
git switch main
git merge --no-ff docs/record-cosign-v0-1-2
git switch main
git merge --squash docs/record-cosign-v0-1-2
git switch main
git merge --ff-only docs/record-cosign-v0-1-2
git switch main
git merge docs/record-cosign-v0-1-2
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
brandon/ci-plugins!22
No description provided.