chore(deps): bump Glyndor/.github/.github/workflows/rust-supply-chain.yml from 1.13.0 to 1.13.2

[dependabot]

Bumps Glyndor/.github/.github/workflows/rust-supply-chain.yml from 1.13.0 to 1.13.2.

Release notes

Sourced from Glyndor/.github/.github/workflows/rust-supply-chain.yml's releases.

v1.13.2

What

Two real security improvements, in the reusables that gate every release.

installer-contract.yml — SHA256SUMS manifest gate

Assert the release workflow publishes a SHA256SUMS manifest. The install scripts verify downloaded binaries against this file; a release that stops producing it is a silent breaking change (install.sh keeps fetching the URL and gets a 404 mid-installer). The check matches the presence of the path on the manifest side, not the upload step name on the workflow side, so it stays valid across workflow renames.

release-verify.yml — per-asset signature verification

Iterates every per-asset .sig (per-binary, per-deb, per-SBOM, per-installer), not just SHA256SUMS.sig. The signature covers each binary independently, so a manifest re-signed to legitimize a swapped binary still fails the check (a manifest-only check would pass that case). Uses the org Ed25519 release key as a new input (release-pubkey-b64) with the current key as default. Skipped for manifest-kind: go because Go modules are versioned by the tag itself.

Why this matters

This closes the per-binary substitution gap that Glyndor/podup#1359 closed in podup's own release workflow. The org reusable should not require every consumer to reimplement it.

Consumer impact

• apt, homebrew-tap, scoop-bucket: Dependabot will propose bumps from v1.13.1 → v1.13.2 in each. Reviewer action: merge or auto-merge per repo policy.
• Older releases without per-asset .sig: release-verify will fail the new gate. New gate, new requirement. Releases that already publish per-asset signatures (the existing convention across the org) pass unchanged.

Bump

Patch bump from v1.13.1. Documentation-only check on top, plus a mandatory verification step. No behaviour change for releases that already publish per-asset .sig files.

Commits

• 3a46ffe ci(release-verify): per-asset signature verification, plus SHA256SUMS gate (#...
• 41a00f6 ci(release-verify): document why the audit step pins bash (#109)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)