[dependabot]

Bumps the github-actions-all group with 2 updates in the / directory: taiki-e/install-action and sigstore/cosign-installer.

Updates taiki-e/install-action from 2.87.31 to 2.90.2

Release notes

Sourced from taiki-e/install-action's releases.

2.90.2

• Update trivy@latest to 0.76.2.

• Update tombi@latest to 1.10.0.

• Update prek@latest to 0.5.10.

• Update mise@latest to 2026.11.2.

• Update mdbook-d2@latest to 0.3.10.

• Update cargo-zigbuild@latest to 0.24.1.

• Update cargo-tarpaulin@latest to 0.37.6.

• Update biome@latest to 2.6.5.

2.90.1

• Update zizmor@latest to 1.32.0.

• Update uv@latest to 0.13.7.

• Update typos@latest to 1.52.0.

• Update tombi@latest to 1.9.9.

• Update syft@latest to 1.56.0.

• Update mise@latest to 2026.11.0.

• Update kache@latest to 2.0.0.

• Update cargo-nextest@latest to 0.9.151.

2.90.0

• Add fallback: skip input option. This is similar to fallback: none but skip unsupported tools instead of error. (#2052)

• Update vacuum@latest to 0.36.2.

• Update release-plz@latest to 0.4.3.

• Update bpf-linker@latest to 0.13.0.

2.89.1

• Install ld.mold symlink when installing mold on Linux. Previously, only mold binary was installed. (#2050, thanks @​FirelightFlagboy)

• Update parse-dockerfile@latest to 0.1.9.

• Update parse-changelog@latest to 0.6.18.

... (truncated)

Commits

• 3a3daaf Release 2.90.2
• 9002010 Update yq manifest
• b15e87a Update vacuum manifest
• 35247b9 Update trivy@latest to 0.76.2
• 851a180 Update tombi@latest to 1.10.0
• 6aa2ee9 Update syft manifest
• eeedd0c Update rclone manifest
• a96a6aa Update protoc-gen-connect-openapi manifest
• ca1644a Update prek@latest to 0.5.10
• 6ba2993 Update mise@latest to 2026.11.2
• Additional commits viewable in compare view

Updates sigstore/cosign-installer from 3.9.1 to 4.1.3

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.3

What's Changed

• Bump Cosign to v3.1.4 (latest release) in sigstore/cosign-installer#257

Full Changelog: sigstore/cosign-installer@v4.1.2...v4.1.3

v4.1.2

What's Changed

• Bump cosign to 3.0.6 in sigstore/cosign-installer#232

v4.1.1

What's Changed

• chore: update default cosign-release to v3.0.5 in sigstore/cosign-installer#223

Full Changelog: sigstore/cosign-installer@v4.1.0...v4.1.1

v4.1.0

What's Changed

We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

• Bump cosign to 3.0.5 in sigstore/cosign-installer#220
• fix: add retry to curl downloads for transient network failures in sigstore/cosign-installer#210

Full Changelog: sigstore/cosign-installer@v4.0.0...v4.1.0

v4.0.0

What's Changed?

Note: You must upgrade to cosign-installer v4 if you want to install Cosign v3+. You may still install Cosign v2.x with cosign-installer v4.

In version v3+, using cosign sign-blob requires adding the --bundle flag which may require you to update your signing command.

• Add support for Cosign v3 releases (#201)

v3.10.1

What's Changed?

Note: cosign-installer v3.x cannot be used to install Cosign v3.x. You must upgrade to cosign-installer v4 in order to use Cosign v3.

Note: This is planned to be the final release of Cosign v2, though we will cut new releases for any critical security or bug fixes. We recommend transitioning to Cosign v3.

• Bump default Cosign to v2.6.1 (#203)

v3.10.0

What's Changed

• Bump default Cosign to v2.6.0 in sigstore/cosign-installer#200

Full Changelog: sigstore/cosign-installer@v3.9.2...v3.10.0

... (truncated)

Commits

• 756fe2d Bump Cosign to v3.1.4 (latest release) (#257)
• b9c3539 Bump actions/setup-go from 6.4.0 to 7.0.0 (#249)
• 84205a0 close race on windows due to reusing filename (#253)
• af595e6 Bump cosign to 3.1.3 (#252)
• 828df1e fix: harden curl download retries against transient GitHub CDN 504s (#240)
• 874852d Bump actions/checkout from 6.0.2 to 7.0.1 (#250)
• 3094a48 wrap path in quotes for powershell (#246)
• e246ae3 test minimum of 1.26 given cosign requirement (#247)
• 6f9f177 Bump cosign to 3.0.6 (#232)
• b5e753a Bump actions/github-script from 8.0.0 to 9.0.0 (#230)
• Additional commits viewable in compare view

[temper-pulseengine]

temper did not enable auto-merge: breaking update sigstore/cosign-installer 3.9.1 -> 4.1.2 needs a human review.

[github-actions]

🔒 HELD — not auto-mergeable (class: grouped-hold). 1/2 grouped bumps hold; first: 3.9.1 -> 4.1.2 changes the major component

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.

[github-actions]

🔒 HELD — not auto-mergeable (class: grouped-hold). 1/2 grouped bumps hold; first: 3.9.1 -> 4.1.2 changes the major component

Auto-merge has been actively disabled and asserted off by the hold gate (#965). For a 0.x crate the MINOR component is the de-facto major (and for 0.0.x, the patch): ordeal 0.9→0.12 auto-merged as "minor" and hung Test+Z3 for days; object 0.39→0.40 (#938) broke 16 call sites across three unrelated newtype surfaces. Merge this BY HAND only once the FULL suite is green, including the separate --features z3-solver path (required context "Z3 Verification") — the discriminator is CI, not a read of the diff.