Merge pull request #2212 from fluxcd/fix-cosign-v3-signing

Fix goreleaser signing with cosign v3 bundles

Author: stefanprodan

.github/workflows/backport.yaml

@@ -7,6 +7,6 @@ jobs:
     permissions:
       contents: write # for reading and creating branches.
       pull-requests: write # for creating pull requests against release branches.
-    uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.16.0
+    uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.17.0
     secrets:
       github-token: ${{ secrets.BOT_GITHUB_TOKEN }}

.github/workflows/cifuzz.yaml

@@ -11,7 +11,7 @@ jobs:
       contents: read # for reading the repository code.
     steps:
       - name: Test suite setup
-        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.16.0
+        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.17.0
         with:
           go-version: 1.27.x
       - name: Smoke test Fuzzers

.github/workflows/e2e.yaml

@@ -13,7 +13,7 @@ jobs:
       contents: read # for reading the repository code.
     steps:
       - name: Test suite setup
-        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.16.0
+        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.17.0
         with:
           go-version: 1.27.x
       - name: Verify
@@ -39,7 +39,7 @@ jobs:
       contents: read # for reading the repository code.
     steps:
       - name: Test suite setup
-        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.16.0
+        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.17.0
         with:
           go-version: 1.27.x
       - name: Setup Flux CLI

.github/workflows/release.yaml

@@ -15,7 +15,7 @@ jobs:
       contents: write # for creating the GitHub release.
       id-token: write # for creating OIDC tokens for signing.
       packages: write # for pushing and signing container images.
-    uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.16.0
+    uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.17.0
     with:
       controller: ${{ github.event.repository.name }}
       release-candidate-prefix: ${{ github.event.inputs.tag }}

.github/workflows/scan.yaml

@@ -11,7 +11,7 @@ jobs:
     permissions:
       contents: read # for reading the repository code.
       security-events: write # for uploading the CodeQL analysis results.
-    uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.16.0
+    uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.17.0
     secrets:
       github-token: ${{ secrets.GITHUB_TOKEN }}
       fossa-token: ${{ secrets.FOSSA_TOKEN }}

.github/workflows/sync-labels.yaml

@@ -11,6 +11,6 @@ jobs:
     permissions:
       contents: read # for reading the labels file.
       issues: write # for creating and updating labels.
-    uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.16.0
+    uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.17.0
     secrets:
       github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Test suite setup
-        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.16.0
+        uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.17.0
         with:
           go-version: 1.27.x
       - name: Run tests

.github/workflows/upgrade-fluxcd-pkg.yaml

@@ -5,6 +5,6 @@ on:
 
 jobs:
   upgrade-fluxcd-pkg:
-    uses: fluxcd/gha-workflows/.github/workflows/upgrade-fluxcd-pkg.yaml@v0.16.0
+    uses: fluxcd/gha-workflows/.github/workflows/upgrade-fluxcd-pkg.yaml@v0.17.0
     secrets:
       github-token: ${{ secrets.BOT_GITHUB_TOKEN }}

.goreleaser.yaml

@@ -44,14 +44,11 @@ sboms:
 # https://goreleaser.com/customization/sign
 signs:
   - cmd: cosign
-    env:
-      - COSIGN_EXPERIMENTAL=1
-    certificate: "${artifact}.pem"
+    signature: "${artifact}.sigstore.json"
     args:
       - sign-blob
       - "--yes"
-      - "--output-certificate=${certificate}"
-      - "--output-signature=${signature}"
+      - "--bundle=${signature}"
       - "${artifact}"
     artifacts: checksum
     output: true