update github action version

Signed-off-by: Nicolas-Peiffer <102670102+Nicolas-Peiffer@users.noreply.github.com>

Author: Nicolas-Peiffer

.github/actions/publish-release/action.yaml

@@ -36,7 +36,7 @@ runs:
   steps:
     # Install go with specific version
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
         go-version: ${{ inputs.go-version }} # same version than the one in the go.mod or in the .go-version
      # Register to ghcr.io container Registry
@@ -48,10 +48,10 @@ runs:
         password: ${{ inputs.registry_password }} 
     # Install ko to publish container images
     - name: Set up Ko
-      uses: ko-build/setup-ko@v0.7
+      uses: ko-build/setup-ko@v0.9
     # Install cosign to sign artfacts with goreleaser 
     - name: Install Cosign
-      uses: sigstore/cosign-installer@v3.5.0
+      uses: sigstore/cosign-installer@v3.10.0
     # Get LDFLAGS with a makefile command
     - shell: bash
       name: Get LDFLAGS

.github/actions/verify-attestations/action.yaml

@@ -25,18 +25,18 @@ runs:
   steps:
     # Install go with specific version
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v6
       with:
         go-version: ${{ inputs.go-version }} # same version than the one in the go.mod or in the .go-version
 
     - shell: bash 
       name : Install dependencies
       run : |
-        go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@v2.5.1
+        go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@v2.7.1
     - shell: bash 
       name: verify image provenance
       id: image-provenance   
       run: |
           slsa-verifier verify-image ${{ inputs.image }} \
           --source-uri  github.com/${{github.repository}} \
-          --builder-id https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v1.10.0
+          --builder-id https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v2.1.0

.github/workflows/Goreleaser.yaml

@@ -22,7 +22,7 @@ jobs:
         digest: ${{ steps.publish-artifacts.outputs.digest }}
       steps:
         - name: Checkout
-          uses: actions/checkout@v4
+          uses: actions/checkout@v5
           with:
                 fetch-depth: 0      
         - name: Publish Artifacts
@@ -43,7 +43,7 @@ jobs:
         actions: read # To read the workflow path.
         id-token: write # To sign the provenance.
         contents: write # To add assets to a release.
-      uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0
+      uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
       with:
         base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
         upload-assets: true 
@@ -54,7 +54,7 @@ jobs:
         actions: read
         id-token: write
         packages: write
-      uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.10.0
+      uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
       with:
         image: ${{ needs.goreleaser.outputs.image }}
         digest: ${{ needs.goreleaser.outputs.digest }}
@@ -72,7 +72,7 @@ jobs:
         packages: write
       steps:
           - name: Checkout
-            uses: actions/checkout@v4
+            uses: actions/checkout@v5
             with:
                   fetch-depth: 0      
           - name: Verify provenance attestations