chore(deps): bump the all group across 1 directory with 2 updates

[dependabot]

Bumps the all group with 2 updates in the / directory: github.com/in-toto/go-witness and github.com/tektoncd/pipeline.

Updates github.com/in-toto/go-witness from 0.8.4 to 0.8.6

Commits

• 0c8bb30 fix: update gitleaks and fix config usage (#499)
• bd01443 feat: add ability to pass headers to archivista client (#498)
• e0990ed chore: bump github.com/open-policy-agent/opa from 1.4.0 to 1.4.2 (#495)
• d6d6d68 chore: bump actions/setup-go from 5.4.0 to 5.5.0 (#496)
• 15ff04a chore: bump actions/dependency-review-action from 4.6.0 to 4.7.0 (#497)
• a0ece0d chore: bump github.com/open-policy-agent/opa from 1.1.0 to 1.4.0 in the go_mo...
• a799b23 chore: bump github/codeql-action from 3.28.16 to 3.28.17 (#492)
• cc3c452 chore: bump golangci/golangci-lint-action from 7.0.0 to 8.0.0 (#491)
• fe21e80 chore: bump github.com/aws/aws-sdk-go from 1.55.6 to 1.55.7 (#489)
• 3e1d242 Update release workflow triggers for efficeincy and witness version (#494)
• Additional commits viewable in compare view

Updates github.com/tektoncd/pipeline from 1.0.3 to 1.0.4

Release notes

Sourced from github.com/tektoncd/pipeline's releases.

Tekton Pipeline release v1.0.4 "Oriental Omnidroid"

-Docs @ v1.0.4 -Examples @ v1.0.4

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.0.4/release.yaml

Attestation

The Rekor UUID for this release is 7f9f39ddb0b3aebc8c331640aaf396e2e401748dbe9537aec401468365bbcd92

Obtain the attestation:

REKOR_UUID=7f9f39ddb0b3aebc8c331640aaf396e2e401748dbe9537aec401468365bbcd92
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.0.4/release.yaml
REKOR_UUID=7f9f39ddb0b3aebc8c331640aaf396e2e401748dbe9537aec401468365bbcd92
Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.0.4@sha256:" + .digest.sha256')
Download the release file
curl -L "$RELEASE_FILE" > release.yaml
For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

... (truncated)

Commits

• 8ffb573 fix: add automated draft release support to release pipeline
• See full diff in compare view

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign lcarva after the PR has been reviewed.
You can assign the PR to them by writing /assign @lcarva in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jkhelil]

/retest

[anithapriyanatarajan]

/lgtm