From 431cb395cdbf1384f31c80e6b62fe2906ffa5f6c Mon Sep 17 00:00:00 2001
From: joshua-stone <joshua.gage.stone@gmail.com>
Date: Thu, 2 Mar 2023 23:54:22 -0500
Subject: [PATCH] fix: update cosign command and pin install (#53)

---
 .github/workflows/build.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e195324..3375f85 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -183,7 +183,7 @@ jobs:
             --disable-content-trust
 
       # Sign container
-      - uses: sigstore/cosign-installer@main
+      - uses: sigstore/cosign-installer@v3.0.1
 
       # Only needed when running `cosign sign` using a key
       - name: Write signing key to disk
@@ -203,7 +203,7 @@ jobs:
 
       - name: Sign container image
         run: |
-          cosign sign --key cosign.key ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
+          cosign sign -y --key cosign.key ${{ steps.registry_case.outputs.lowercase }}/${{ steps.build_image.outputs.image }}@${TAGS}
         env:
           TAGS: ${{ steps.push.outputs.digest }}
           COSIGN_EXPERIMENTAL: false