Merge pull request #3 from Letdown2491/dependabot/github_actions/sigstore/cosign-installer-4.1.2

Bump sigstore/cosign-installer from 3.9.1 to 4.1.2

Author: Letdown2491

.github/workflows/publish.yml

@@ -112,7 +112,7 @@ jobs:
       - name: audit for personal information
         run: ./scripts/publish-audit.sh "${{ steps.ref.outputs.local }}"
 
-      - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         if: ${{ !inputs.allow_unsigned }}
 
       # Twice, because they do not share a credential store. podman writes

.github/workflows/release.yml

@@ -138,7 +138,7 @@ jobs:
           "./$name" --version
           echo "name=$name" >> "$GITHUB_OUTPUT"
 
-      - uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       # One bundle rather than a separate .sig and .pem: cosign deprecated
       # --output-signature and --output-certificate, and the flags that