chore(deps): update oras-project/setup-oras action to v2

.gitea/workflows/golang-linters.yaml

@@ -26,4 +26,4 @@ jobs:
         go-version: ${{ matrix.go }}
     - uses: golangci/golangci-lint-action@v9.2.0
       with:
-        version: v2.12.1 # renovate: datasource=github-releases depName=golangci/golangci-lint
+        version: v2.11.4 # renovate: datasource=github-releases depName=golangci/golangci-lint

.gitea/workflows/release.yaml

@@ -19,7 +19,7 @@ jobs:
       run: apt-get update && apt-get install --yes curl
     - name: Install syft
       env:
-        SYFT_VERSION: "1.44.0" # renovate: datasource=github-releases depName=anchore/syft
+        SYFT_VERSION: "1.42.4" # renovate: datasource=github-releases depName=anchore/syft
       run: |
         OS="$(uname | tr '[:upper:]' '[:lower:]')"
         ARCH="$(dpkg --print-architecture)"
@@ -33,7 +33,7 @@ jobs:
         rm syft_${SYFT_VERSION}_${OS}_${ARCH}.deb
     - uses: sigstore/cosign-installer@v4.1.1
       with:
-        cosign-release: "v3.0.6" # renovate: datasource=github-tags depName=sigstore/cosign
+        cosign-release: "v2.6.3" # renovate: datasource=github-tags depName=sigstore/cosign
     - uses: docker/setup-qemu-action@v4.0.0
       with:
         image: harbor.cryptic.systems/docker/tonistiigi/binfmt:latest
@@ -52,7 +52,7 @@ jobs:
         GITEA_TOKEN: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
         GONOSUMDB: ${{ vars.GONOSUMDB }}
         GOPROXY: ${{ vars.GOPROXY }}
-      uses: goreleaser/goreleaser-action@v7.2.1
+      uses: goreleaser/goreleaser-action@v7.1.0
       with:
         version: v2.15.4 # renovate: datasource=github-releases depName=goreleaser/goreleaser
         args: release --clean