From ace1a65c54e1219560edd597c18886e97d8a2268 Mon Sep 17 00:00:00 2001 From: Tom Willemsen Date: Fri, 29 Nov 2024 09:41:19 +0000 Subject: [PATCH] Bump sigstore, configure dependabot to bump it for us in future --- .github/dependabot.yml | 6 ++++++ .github/workflows/release.yml | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..12301490 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,6 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 66f0530c..c92bc999 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -67,7 +67,7 @@ jobs: name: python-package-distributions path: dist/ - name: Sign the dists with Sigstore - uses: sigstore/gh-action-sigstore-python@v2.1.1 + uses: sigstore/gh-action-sigstore-python@v3.0.0 with: inputs: >- ./dist/*.tar.gz