[dependabot]

Bumps the github-actions group with 2 updates: sigstore/cosign-installer and jaxxstorm/action-install-gh-release.

Updates sigstore/cosign-installer from 4.1.2 to 4.1.3

Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.3

What's Changed

• Bump Cosign to v3.1.4 (latest release) in sigstore/cosign-installer#257

Full Changelog: sigstore/cosign-installer@v4.1.2...v4.1.3

Commits

• 756fe2d Bump Cosign to v3.1.4 (latest release) (#257)
• b9c3539 Bump actions/setup-go from 6.4.0 to 7.0.0 (#249)
• 84205a0 close race on windows due to reusing filename (#253)
• af595e6 Bump cosign to 3.1.3 (#252)
• 828df1e fix: harden curl download retries against transient GitHub CDN 504s (#240)
• 874852d Bump actions/checkout from 6.0.2 to 7.0.1 (#250)
• 3094a48 wrap path in quotes for powershell (#246)
• e246ae3 test minimum of 1.26 given cosign requirement (#247)
• See full diff in compare view

Updates jaxxstorm/action-install-gh-release from 3.0.0 to 4.0.0

Release notes

Sourced from jaxxstorm/action-install-gh-release's releases.

v4.0.0

Highlights

• Install binaries from nested release archives, including cargo-make's versioned wrapper directories (#63, #75, #197).
• Improve private release downloads: honor the token input first and provide actionable guidance for HTTP 404 errors (#56, #197).
• Support anonymous downloads from public repositories (#85, #201).
• Support assets without platform or architecture in their names, with isolated cache namespaces for matching modes.
• Add unit tests with enforced coverage and cargo-make integration coverage for both 0.36.12 and latest.
• Refresh dependencies and rebuild the distributed action.

Upgrade notes

• The token input now takes precedence over the GITHUB_TOKEN environment variable. Pass a cross-repository token explicitly using with.token. The default input remains ${{ github.token }}.
• asset-name selects the release asset, not the filenames inside an extracted archive. Use binaries-location to restrict the directory whose files are installed.
• Archive copy errors now fail immediately rather than continuing installation.

Usage

- uses: jaxxstorm/action-install-gh-release@v4.0.0
  with:
    repo: owner/repository

Full changelog: jaxxstorm/action-install-gh-release@v3.0.0...v4.0.0

Commits

• b82b205 chore(release): prepare v4.0.0
• 02d38c8 Merge pull request #75 from jaxxstorm/cargo_make
• cf1581d ci: invoke cargo-make through its Cargo subcommand
• 7f5d643 ci: refresh cargo-make integration tests against master
• b969cc2 Merge pull request #200 from jaxxstorm/renovate/octokit-monorepo
• 6309909 Merge pull request #199 from jaxxstorm/renovate/typescript-6.x
• e5e9422 Merge pull request #201 from jaxxstorm/fix/85-public-repo-token
• bea04da fix: explicitly support anonymous public release installs
• 5ee6b37 chore(deps): update octokit monorepo
• 917b585 chore(deps): update dependency typescript to v6.0.3
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions