Add lotp_targets field to untrusted_checkout_exec findings (#386) #37

	name: goreleaser

	on:
	push:
	# run only against tags
	tags:
	- "v0.[0-9]+.[0-9]+"
	- "v1.[0-9]+.[0-9]+"

	env:
	GO_VERSION: 1.25
	GO_RELEASER_VERSION: v2.4.7

	permissions: {}

	jobs:
	goreleaser:
	runs-on: ubuntu-latest
	permissions:
	contents: write
	packages: write
	id-token: write
	steps:
	- uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
	with:
	egress-policy: audit
	- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
	with:
	fetch-depth: 0
	- name: Setup Go
	uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
	with:
	go-version: ${{ env.GO_VERSION }}
	cache: false
	- uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
	- name: Login to GitHub Container Registry to allow cosign signature push
	run: echo "$DOCKER_PASSWORD" \| docker login ghcr.io --username "$DOCKER_USERNAME" --password-stdin
	env:
	DOCKER_USERNAME: ${{ github.actor }}
	DOCKER_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
	- name: Run GoReleaser
	uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
	with:
	distribution: goreleaser
	version: ${{ env.GO_RELEASER_VERSION }} # Not pinnable by hash, nor does it verify its signature
	args: release --clean
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback