chore: Bump the actions group with 3 updates

[dependabot]

Bumps the actions group with 3 updates: Glyndor/.github/.github/workflows/dco.yml, Glyndor/.github/.github/workflows/line-limit.yml and Glyndor/.github/.github/workflows/workflow-lint.yml.

Updates Glyndor/.github/.github/workflows/dco.yml from 1.13.0 to 1.13.2

Release notes

Sourced from Glyndor/.github/.github/workflows/dco.yml's releases.

v1.13.2

What

Two real security improvements, in the reusables that gate every release.

installer-contract.yml — SHA256SUMS manifest gate

Assert the release workflow publishes a SHA256SUMS manifest. The install scripts verify downloaded binaries against this file; a release that stops producing it is a silent breaking change (install.sh keeps fetching the URL and gets a 404 mid-installer). The check matches the presence of the path on the manifest side, not the upload step name on the workflow side, so it stays valid across workflow renames.

release-verify.yml — per-asset signature verification

Iterates every per-asset .sig (per-binary, per-deb, per-SBOM, per-installer), not just SHA256SUMS.sig. The signature covers each binary independently, so a manifest re-signed to legitimize a swapped binary still fails the check (a manifest-only check would pass that case). Uses the org Ed25519 release key as a new input (release-pubkey-b64) with the current key as default. Skipped for manifest-kind: go because Go modules are versioned by the tag itself.

Why this matters

This closes the per-binary substitution gap that Glyndor/podup#1359 closed in podup's own release workflow. The org reusable should not require every consumer to reimplement it.

Consumer impact

• apt, homebrew-tap, scoop-bucket: Dependabot will propose bumps from v1.13.1 → v1.13.2 in each. Reviewer action: merge or auto-merge per repo policy.
• Older releases without per-asset .sig: release-verify will fail the new gate. New gate, new requirement. Releases that already publish per-asset signatures (the existing convention across the org) pass unchanged.

Bump

Patch bump from v1.13.1. Documentation-only check on top, plus a mandatory verification step. No behaviour change for releases that already publish per-asset .sig files.

Commits

• 3a46ffe ci(release-verify): per-asset signature verification, plus SHA256SUMS gate (#...
• 41a00f6 ci(release-verify): document why the audit step pins bash (#109)
• See full diff in compare view

Updates Glyndor/.github/.github/workflows/line-limit.yml from 1.13.0 to 1.13.2

Release notes

Sourced from Glyndor/.github/.github/workflows/line-limit.yml's releases.

v1.13.2

What

Two real security improvements, in the reusables that gate every release.

installer-contract.yml — SHA256SUMS manifest gate

Assert the release workflow publishes a SHA256SUMS manifest. The install scripts verify downloaded binaries against this file; a release that stops producing it is a silent breaking change (install.sh keeps fetching the URL and gets a 404 mid-installer). The check matches the presence of the path on the manifest side, not the upload step name on the workflow side, so it stays valid across workflow renames.

release-verify.yml — per-asset signature verification

Iterates every per-asset .sig (per-binary, per-deb, per-SBOM, per-installer), not just SHA256SUMS.sig. The signature covers each binary independently, so a manifest re-signed to legitimize a swapped binary still fails the check (a manifest-only check would pass that case). Uses the org Ed25519 release key as a new input (release-pubkey-b64) with the current key as default. Skipped for manifest-kind: go because Go modules are versioned by the tag itself.

Why this matters

This closes the per-binary substitution gap that Glyndor/podup#1359 closed in podup's own release workflow. The org reusable should not require every consumer to reimplement it.

Consumer impact

• apt, homebrew-tap, scoop-bucket: Dependabot will propose bumps from v1.13.1 → v1.13.2 in each. Reviewer action: merge or auto-merge per repo policy.
• Older releases without per-asset .sig: release-verify will fail the new gate. New gate, new requirement. Releases that already publish per-asset signatures (the existing convention across the org) pass unchanged.

Bump

Patch bump from v1.13.1. Documentation-only check on top, plus a mandatory verification step. No behaviour change for releases that already publish per-asset .sig files.

Commits

• 3a46ffe ci(release-verify): per-asset signature verification, plus SHA256SUMS gate (#...
• 41a00f6 ci(release-verify): document why the audit step pins bash (#109)
• See full diff in compare view

Updates Glyndor/.github/.github/workflows/workflow-lint.yml from 1.13.0 to 1.13.2

Release notes

Sourced from Glyndor/.github/.github/workflows/workflow-lint.yml's releases.

v1.13.2

What

Two real security improvements, in the reusables that gate every release.

installer-contract.yml — SHA256SUMS manifest gate

Assert the release workflow publishes a SHA256SUMS manifest. The install scripts verify downloaded binaries against this file; a release that stops producing it is a silent breaking change (install.sh keeps fetching the URL and gets a 404 mid-installer). The check matches the presence of the path on the manifest side, not the upload step name on the workflow side, so it stays valid across workflow renames.

release-verify.yml — per-asset signature verification

Iterates every per-asset .sig (per-binary, per-deb, per-SBOM, per-installer), not just SHA256SUMS.sig. The signature covers each binary independently, so a manifest re-signed to legitimize a swapped binary still fails the check (a manifest-only check would pass that case). Uses the org Ed25519 release key as a new input (release-pubkey-b64) with the current key as default. Skipped for manifest-kind: go because Go modules are versioned by the tag itself.

Why this matters

This closes the per-binary substitution gap that Glyndor/podup#1359 closed in podup's own release workflow. The org reusable should not require every consumer to reimplement it.

Consumer impact

• apt, homebrew-tap, scoop-bucket: Dependabot will propose bumps from v1.13.1 → v1.13.2 in each. Reviewer action: merge or auto-merge per repo policy.
• Older releases without per-asset .sig: release-verify will fail the new gate. New gate, new requirement. Releases that already publish per-asset signatures (the existing convention across the org) pass unchanged.

Bump

Patch bump from v1.13.1. Documentation-only check on top, plus a mandatory verification step. No behaviour change for releases that already publish per-asset .sig files.

Commits

• 3a46ffe ci(release-verify): per-asset signature verification, plus SHA256SUMS gate (#...
• 41a00f6 ci(release-verify): document why the audit step pins bash (#109)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions