zeroclaw

Files

fettpl fed1997f62 ci: add cosign keyless signing for release artifacts

- Add sigstore/cosign keyless signing to the release workflow
- Each artifact gets a detached .sig signature and .pem certificate
- Uses GitHub Actions OIDC for keyless signing (no secret management)
- Adds id-token: write permission for OIDC token generation
- Signatures and certificates are uploaded alongside binaries

Users can verify artifacts with:
  cosign verify-blob --certificate <file>.pem --signature <file>.sig \
    --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
    --certificate-identity-regexp="github.com/zeroclaw-labs/zeroclaw" \
    <file>

Closes #365

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-16 17:55:40 +01:00

auto-response.yml

build(deps): bump actions/github-script from 7 to 8 (#313 )

2026-02-16 07:42:10 -05:00

ci.yml

ci: route trusted pushes to self-hosted runner (#369 )

2026-02-16 10:56:53 -05:00

docker.yml

ci: route trusted docker and release publish jobs to self-hosted (#371 )

2026-02-16 11:00:25 -05:00

labeler.yml

fix(ci): mitigate GitHub API rate-limit failures (#334 )