From 86044ec6c70ad1a8ed57f64c106bc44284104e7c Mon Sep 17 00:00:00 2001
From: Kobi Hikri <kobi.hikri@gmail.com>
Date: Tue, 14 Jul 2026 18:19:09 +0300
Subject: [PATCH] ci: pin pyTooling/Actions/releaser to a SHA instead of the r6
 branch

The publish job holds permissions: write-all and passes GITHUB_TOKEN to this
third-party action, previously pinned to the mutable r6 branch. Pin to the
branch head commit (pyTooling also publishes v6.x tags).
---
 .github/workflows/msbuild.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/msbuild.yml b/.github/workflows/msbuild.yml
index c88ec7115..05e964139 100644
--- a/.github/workflows/msbuild.yml
+++ b/.github/workflows/msbuild.yml
@@ -70,7 +70,7 @@ jobs:
     
     - name: Update latest release
       # see https://github.com/pyTooling/Actions/tree/r6/releaser
-      uses: pyTooling/Actions/releaser@r6
+      uses: pyTooling/Actions/releaser@c58169077d7a6289af1885bb0711eb263a57727d # r6
       with:
         tag: latest
         rm: true