bump scaffolding to 0.4.12

[bobcallaway]

Signed-off-by: Bob Callaway bcallaway@google.com

Summary

Release Note

Documentation

[codecov-commenter]

Codecov Report

Merging #2402 (c1afcfb) into main (be215cf) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #2402   +/-   ##
=======================================
  Coverage   30.14%   30.14%           
=======================================
  Files         136      136           
  Lines        8438     8438           
=======================================
  Hits         2544     2544           
  Misses       5565     5565           
  Partials      329      329           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[bobcallaway]

@vaikas @priyawadhwa this model of pinning to back versions of rekor/fulcio as well as older versions of cosign via scaffolding feels very broken to me. Are we actually getting meaningful coverage from these tests in PRs?

[vaikas]

That's a great point @bobcallaway and something that we did think about on how to best handle but never got around to it. Do you think we should be grabbing the latest or head for things like Fulcio/Rekor?

[bobcallaway]

In rekor, @priyawadhwa implemented a check that ran rekor-cli against 3 versions (HEAD, and 2 latest published tags). For cosign, I would want to run it against prod, and perhaps a matrix of 3 versions of both rekor & fulcio for adding coverage to those running private instances of rekor and/or fulcio.

[vaikas]

Ok, that's doable. But only against released versions, correct?

…

On Wed, Nov 2, 2022 at 12:49 PM Bob Callaway ***@***.***> wrote: In rekor, @priyawadhwa implemented a check that ran rekor-cli against 3 versions (HEAD, and 2 latest published tags). For cosign, I would want to run it against prod, and perhaps a matrix of 3 versions of both rekor & fulcio for adding coverage to those running private instances of rekor and/or fulcio. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you modified the open/close state.Message ID: ***@***.***>

[bobcallaway]

Ok, that's doable. But only against released versions, correct?
…
On Wed, Nov 2, 2022 at 12:49 PM Bob Callaway @.> wrote: In rekor, @priyawadhwa implemented a check that ran rekor-cli against 3 versions (HEAD, and 2 latest published tags). For cosign, I would want to run it against prod, and perhaps a matrix of 3 versions of both rekor & fulcio for adding coverage to those running private instances of rekor and/or fulcio. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you modified the open/close state.Message ID: @.>

yup