From 8952b908898db7e1dfde94b8e84cf58233842f6c Mon Sep 17 00:00:00 2001 From: Litju Date: Sun, 16 Aug 2026 19:58:46 -0300 Subject: [PATCH] fix: pin public release workflows --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/scorecard.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 24c4cbb..26df99d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -52,7 +52,7 @@ jobs: - name: Checkout uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 - name: Set up Node - uses: actions/setup-node@6249970729cb0ef3589644e2896645e5dc5ba9c38 + uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 with: node-version: "22" cache: npm diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5d1ea70..40b4099 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,6 +33,6 @@ jobs: path: dist/secscanmonitor.cdx.json if-no-files-found: error - name: Attest SBOM provenance - uses: actions/attest@e69f48acb82d1966a394da916b4c1698aa569d6 + uses: actions/attest@67422f5511b7ff725f4dbd6fb9bd2cd925c65a8d with: subject-path: dist/secscanmonitor.cdx.json diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 053e65f..e47d695 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -28,7 +28,7 @@ jobs: persist-credentials: false fetch-depth: 0 - name: Run Scorecard - uses: ossf/scorecard-action@99c09fe975337306107572b4fdf4db224cf8e2f2 + uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc with: results_file: scorecard-results.sarif results_format: sarif