Claude f9809550c8 ci: sign every published runner image by digest (zegit#262) ...

zegit's arc-runner-pin.sh pins a runner image only when cosign verifies
its digest against the runner-image public key (zegit#143), but nothing
signed the images, so the pin refused every day. Sign the digest with
the RUNNER_IMAGE_COSIGN_KEY repository secret after the publish and
verify the signature in the same run. sign_only re-signs an image
published before signing existed.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_0147GvtJgsTjDGcrfvJsx5jS

2026-10-19 14:00:56 +02:00

..

workflows

ci: sign every published runner image by digest (zegit#262)

2026-10-19 14:00:56 +02:00