ci: drop pre-cosign-v3 goreleaser versions from tests

GoReleaser v2.13.0 was the first release to ship the cosign v3
sigstore-bundle 'checksums.txt.sigstore.json' alongside the archive.
Earlier releases only publish a cosign v2 detached '.sig', which the
action's verifier does not understand and silently skips.

Drop '~> 1.26' / '~> 2.6' / 'v0.182.0' / '~> v1' from the matrix and
the install tests; pin '~> 2.13' as the minimum-supported version we
actively exercise in CI. Document v2.13.0 as the minimum cosign-
verifiable version in the README.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Carlos Alexandro Becker 2026-04-18 15:37:24 -03:00
parent be2e8a39ba
commit ec010bb2bf
No known key found for this signature in database
3 changed files with 16 additions and 26 deletions

View file

@ -32,8 +32,7 @@ jobs:
- windows-latest
version:
- latest
- '~> 2.6'
- '~> 1.26'
- '~> 2.13'
distribution:
- goreleaser
- goreleaser-pro
@ -74,8 +73,7 @@ jobs:
matrix:
version:
- latest
- '~> 2.6'
- '~> 1.26'
- '~> 2.13'
distribution:
- goreleaser
- goreleaser-pro