发布

  • fix(ci): remove comments from JSON provenance (#1330)

    frostbyte_neo 发布于 2025-12-08 13:15:05 +00:00

    • fix(ci): remove comments from JSON provenance

    JSON does not support comments. Removed DevSkim ignore comments that
    were causing cosign to fail with 'invalid character # after object'.

    Note: DevSkim will flag sha1 as weak hash - dismiss in UI as this is
    required by SLSA provenance spec (field name, not cryptographic usage).

    • chore: bump version to 1.3.5
    下载附件