ghcr.io/ko-build/ko:v0.13.0 is not signed

[imjasonh]

https://github.com/ko-build/ko/actions/runs/4386793516/jobs/7681559191

This is due to a change in cosign v2 that requires the --yes flag to confirm, which was not set on the release workflow. Related: #973

We can fix this in a few ways, none of which are super ideal. In descending preference order:

1. merge fix release workflow #977 and cut v0.13.1 -- v0.13.0 will still not be signed, but at least latest will be
2. define a new manual workflow that just signs the image -- it will be signed with this workflow's details, not the normal release workflow
3. merge fix release workflow #977 and move the v0.13.0 tag to point to it-- this will break Go module users since v0.13.0 is already present in the go mod cache 👎

[developer-guy]

May I do these ? ☝️🆙

[imjasonh]

I think we need to decide which one we want to do first 😅

[vdemeester]

I would rather not do 3. as.. as said, it will break go modules. I think cutting a v0.13.1 is fine, or have a manual workflow to sign. So I think 1. is the easiest/quickest to do, but 2. seems fine as well 👼🏼

[developer-guy]

my vote is also to continue with the first one since I agree with the @vdemeester, this is the easiest way to go with!

[developer-guy]

as #977 merged, will you @imjasonh cut a new release 0.13.1?

[imjasonh]

as #977 merged, will you @imjasonh cut a new release 0.13.1?

I think we're going to plan a 0.14 release shortly, in preparation for #1025

[github-actions]

This issue is stale because it has been open for 90 days with no
activity. It will automatically close after 30 more days of
inactivity. Keep fresh with the 'lifecycle/frozen' label.

[cpanato]

will close this, resolved in v0.14.x