Merge pull request #2630 from ublue-os/main

[pull] stable-f44 from main

Author: renner0e

.github/renovate.json5

@@ -63,10 +63,13 @@
       "enabled": false
     },
     {
+      "matchManagers": ["github-actions"],
       "matchDepNames": [
-        "github/codeql-action/upload-sarif"
+        "!oras-project/setup-oras",
+        "!sigstore/cosign-installer",
+        "!anchore/sbom-action"
       ],
-      "extends": ["schedule:weekly"]
+      "schedule": ["on sunday"]
     }
   ]
 }

.github/workflows/reusable-build.yml

@@ -97,6 +97,9 @@ jobs:
       # FIXME: Implement retries for stuff like this
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        # be careful when upgrading major versions
+        with:
+          cosign-release: 'v3.1.2'
 
       - name: Install ORAS
         uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
@@ -444,7 +447,7 @@ jobs:
 
       - name: Attestation
         if: inputs.publish
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
         with:
           subject-name: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.pre-push.outputs.digest }}

.github/workflows/scorecard.yml

@@ -71,6 +71,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: results.sarif

Justfile

@@ -202,14 +202,16 @@ build $image=default_image $tag=default_tag $flavor=default_flavor $rechunk="fal
         ALL_IMAGES+=("${AKMODS_NVIDIA_OPEN}")
     fi
 
-    cosign verify \
+    {{ retry_function }}
+
+    retry 5 60 cosign verify \
       --certificate-oidc-issuer https://token.actions.githubusercontent.com \
       --certificate-identity-regexp="github.com/get-aurora-dev/common/.github/workflows/*" \
       "{{ common }}"
 
     ALL_IMAGES+=("{{ common }}")
 
-    cosign verify \
+    retry 5 60 cosign verify \
       --certificate-oidc-issuer https://token.actions.githubusercontent.com \
       --certificate-identity-regexp="github.com/coreos/chunkah/.github/workflows/*" \
       "{{ chunkah }}"
@@ -218,8 +220,6 @@ build $image=default_image $tag=default_tag $flavor=default_flavor $rechunk="fal
 
     ALL_IMAGES+=("{{ brew }}")
 
-    {{ retry_function }}
-
     # I hate this immensely, podman build/pull with --retry does not work for
     # transient network issues
     if [[ "${retry_pull}" == "true" ]]; then

README.md

@@ -46,7 +46,3 @@ sudo mokutil --import public_key.der
 ## Repobeats
 
 ![Alt](https://repobeats.axiom.co/api/embed/c86e98a6654e55f789375ff210dd4eb95f757906.svg "Repobeats analytics image")
-
-## Star History
-
-[![Star History Chart](https://api.star-history.com/svg?repos=ublue-os/aurora&type=Date)](https://www.star-history.com/#ublue-os/aurora&Date)

image-versions.yml

@@ -9,13 +9,13 @@ images:
   - name: common
     image: ghcr.io/get-aurora-dev/common
     tag: latest
-    digest: sha256:a89ec8048e37424da098c564bad6c02243e9e3d41d6f5c536a0cb698fcd25f27
+    digest: sha256:9c3378b7c3612b3b08b9c79bd0e6fdfa7eaeef31fdbbb9e6ff491b3326d85338
 
   # https://github.com/ublue-os/brew
   - name: brew
     image: ghcr.io/ublue-os/brew
     tag: latest
-    digest: sha256:ff3a0f6d6d9ff372fbc22e0131800a1755fd5031903ba1d7630050f45f8a476e
+    digest: sha256:bcd5391e8e2b925e6ad02b8a5b7cfac039a18c419b891d2b244e2758ebe2b9d1
 
   # https://github.com/coreos/chunkah
   - name: chunkah