mirror of
https://github.com/goreleaser/goreleaser-action.git
synced 2026-05-16 15:40:34 +00:00
4f893a457d
Download checksums.txt for the release and verify the SHA-256 of the downloaded archive against it. When cosign is available in PATH, also download checksums.txt.sigstore.json and verify the signature against the goreleaser/goreleaser-pro release workflow identity. Both steps degrade gracefully (with a warning) when the corresponding artifacts or tooling are missing. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| ci.yml | ||
| dependabot-build.yml | ||
| test.yml | ||
| validate.yml | ||