ci: pin pyTooling/Actions/releaser to a SHA instead of the r6 branch

[kobihikri]

What this does

.github/workflows/msbuild.yml's publish job pins the third-party action pyTooling/Actions/releaser to the mutable @r6 branch (line 73). That job holds permissions: write-all and passes token: ${{ secrets.GITHUB_TOKEN }}. This pins it to a full commit SHA instead:

uses: pyTooling/Actions/releaser@c58169077d7a6289af1885bb0711eb263a57727d # r6

Why

@r6 is a branch (not a tag) — pyTooling/Actions moves it as new 6.x releases land. So whatever that branch points to at run time executes with a write-all GITHUB_TOKEN in scope, which could tamper with the latest release artifacts users download. Pinning to a commit SHA closes that moving-target window (the tj-actions/changed-files class of risk) while keeping behavior identical.

I pinned to the branch's current head commit so nothing changes functionally. pyTooling/Actions also publishes immutable v6.x tags (e.g. v6.7.0) if you'd prefer a version-style pin — happy to switch to that.

One-line change. (The build job's microsoft/setup-msbuild@v3 holds no secret, so I left it alone.)

---

Disclosure: I used an AI tool to help spot this and prepare the change; I verified the branch-vs-tag distinction and the pinned SHA myself and take responsibility for it.

Summary by Sourcery

CI:

• Update the msbuild workflow to use a commit-SHA-based reference for pyTooling/Actions/releaser rather than the r6 branch.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Pins the pyTooling/Actions/releaser GitHub Action in the msbuild publish job from the mutable r6 branch to a specific commit SHA to eliminate supply-chain risk while preserving current behavior.

File-Level Changes

Change	Details	Files
Pin the releaser GitHub Action from a mutable branch reference to an immutable commit SHA in the publish workflow.	Update the uses: reference for pyTooling/Actions/releaser from @r6 to a specific commit SHA corresponding to the current r6 head. Add an inline comment noting that the pinned SHA represents the r6 branch for future maintainers.	.github/workflows/msbuild.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[r6]

im a person not a branch or a tag 😭