fix: disable cosign dependency (#984)

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

Author: oliverbaehler

.github/workflows/releaser.yml

@@ -28,7 +28,7 @@ jobs:
       - uses: creekorful/goreportcard-action@1f35ced8cdac2cba28c9a2f2288a16aacfd507f9 # v1.0
       - uses: anchore/sbom-action/download-syft@57aae528053a48a3f6235f2d9461b05fbcb7366d
       - name: Install Cosign
-        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+        uses: sigstore/cosign-installer@fb28c2b6339dcd94da6e4cbcbc5e888961f6f8c3 # DO NOT UPDATE v3.9.0
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7.0.0
         with:

renovate.json

@@ -20,6 +20,11 @@
       "matchManagers": ["github-actions", "flux"],
       "groupName": "all-ci-updates",
       "updateTypes": ["major", "minor", "patch"]
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "matchPackageNames": ["sigstore/cosign-installer"],
+      "enabled": false
     }
   ],
   "customManagers": [