Merge remote-tracking branch 'origin/renovate/sigstore-cosign-installer-3.x'

Author: TMUniversal

.github/workflows/build.yml

@@ -46,7 +46,7 @@ jobs:
           go-version-file: go.mod
           check-latest: true
           cache-dependency-path: "**/*.sum"
-      - uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
+      - uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
       - uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
       - name: setup-tparse
         run: go install github.com/mfridman/tparse@latest

.github/workflows/release.yml

@@ -129,7 +129,7 @@ jobs:
         with:
           node-version: 20
 
-      - uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
+      - uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
       - name: Confirm cosign installation
         run: cosign version