089972db87
This will simplify secure installation of composer in GitHub Actions to two
calls to `gh` cli with no need to manually import any PGP signing keys:
gh release --repo composer/composer download --pattern composer.phar
gh attestation verify --repo composer/composer composer.phar
Given that the current PGP signing key is stored as a GitHub Action secret,
this type of attestation is no less secure than the existing PGP signing.
|
||
|---|---|---|
| .. | ||
| workflows | ||
| CONTRIBUTING.md | ||
| ISSUE_TEMPLATE.md | ||
| dependabot.yml | ||
| pull_request_template.md | ||