Merge pull request #107 from controlplaneio-fluxcd/pin-cosign

Pin cosign to v2.6.1

Author: stefanprodan

.github/dependabot.yaml

@@ -9,6 +9,3 @@ updates:
           - "*"
     schedule:
       interval: "weekly"
-    ignore:
-      - dependency-name: "sigstore/cosign-installer"
-        update-types: ["version-update:semver-major"]

.github/workflows/release.yml

@@ -27,6 +27,8 @@ jobs:
         uses: azure/[email protected]
       - name: Setup Cosign
         uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
+        with:
+          cosign-release: v2.6.1 # TODO: remove after Flux 2.8 with support for cosign v3
       - name: Login to GitHub Container Registry
         uses: docker/[email protected]
         with: