From 0562d5dcd6e94dcd375ff27230e12ceac5a5ada7 Mon Sep 17 00:00:00 2001
From: Tang Rufus <tangrufus@gmail.com>
Date: Tue, 20 Oct 2026 07:42:31 +0100
Subject: [PATCH] Modernize `release` workflow

- Disable caching to prevent cache-poisoning attacks
- Upgrade runner to `ubuntu-26.04`
- Run steps in parallel
- Install `cosign` for goreleaser-action to verify the integrity of its downloaded GoReleaser archive
- Pin `actions/attest` versions to major only (consistent with project style)
---
 .github/workflows/release.yml | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cba99d56..e4aa668b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,21 +8,40 @@ on:
 
 permissions: {}
 
+cache-mode: none
+
 jobs:
   goreleaser:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-26.04
     permissions:
       contents: read
       id-token: write
       attestations: write
+    cache-mode: none
     steps:
-      - uses: actions/checkout@v7
+      - id: checkout
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
+        background: true
+
+      # For goreleaser-action to verify the integrity of its downloaded GoReleaser archive
+      - uses: sigstore/cosign-installer@v4
+        background: true
+
+      - uses: anchore/sbom-action/download-syft@v0
+        background: true
+
+      - wait: checkout
+
       - uses: actions/setup-go@v7
         with:
           go-version-file: 'go.mod'
-      - uses: anchore/sbom-action/download-syft@v0
+          cache: false
+
+      - wait-all:
+
       - name: GoReleaser release
         uses: goreleaser/goreleaser-action@v7
         with:
@@ -30,6 +49,7 @@ jobs:
           args: release
         env:
           GITHUB_TOKEN: ${{ secrets.GORELEASER_GITHUB_ACCESS_TOKEN }}
-      - uses: actions/attest@v4.2.2
+
+      - uses: actions/attest@v4
         with:
           subject-checksums: ./dist/trellis_checksums.txt