Yuneng Jiang 30565581be [Infra] Pin cosign.pub verification to initial commit hash ... Pin all cosign public key references to the immutable commit hash (0112e53) that first introduced the key, instead of fetching it from the release tag. This addresses the concern that an attacker with push access could replace the key on main/tags and re-sign tampered images. Docs now show two verification methods: commit hash (recommended) and release tag (convenience), with explanation of why the hash is stronger. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>		2026-04-06 22:53:23 -07:00
..
actions/helm-oci-chart-releaser	fix: address zizmor comments	2026-03-26 21:09:01 -07:00
codeql	[Infra] Improve CodeQL scanning coverage and schedule	2026-03-27 12:04:09 -07:00
ISSUE_TEMPLATE	docs: document new github + gitlab ci scripts	2026-03-25 20:17:10 -07:00
observatory	Add observatory test workflow for RC/stable releases	2026-03-01 15:30:09 -03:00
scripts	Update .github/scripts/close_duplicate_issues.py	2026-02-28 00:17:12 -03:00
workflows	[Infra] Pin cosign.pub verification to initial commit hash	2026-04-06 22:53:23 -07:00
dependabot.yaml	fix: address zizmor comments	2026-03-26 21:09:01 -07:00
deploy-to-aws.png	Add files via upload	2023-10-25 16:33:53 -07:00
FUNDING.yml	Update FUNDING.yml	2023-09-22 09:51:35 -07:00
pull_request_template.md	refactor: update pr template to invite users to slack oss	2026-03-14 15:19:40 -07:00
template.yaml	(chore) cleanup	2024-02-09 09:28:13 -08:00