From c8169e774052eccff3f0137838c4b45cfc51b1d1 Mon Sep 17 00:00:00 2001 From: Jimisola Laursen Date: Sun, 23 Aug 2026 16:35:54 +0200 Subject: [PATCH] fix(ci): pin the download-dists action reference to a commit CodeQL flagged actions/unpinned-tag: @main is mutable, so a compromised or force-pushed reqstool/.github main would execute through this reference with no review. Pinned to the commit that added the action, matching the `@ # main YYYY-MM-DD` convention used elsewhere here. Went in as @main only because no commit SHA existed to pin to until reqstool/.github#94 merged. Signed-off-by: Jimisola Laursen --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0d51839..c93ee66 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -109,7 +109,7 @@ jobs: permissions: id-token: write steps: - - uses: reqstool/.github/.github/actions/download-dists@main + - uses: reqstool/.github/.github/actions/download-dists@ef815eae0bca7160cdc714126cac73f76d638b39 # main 2026-08-23 with: artifact: dist-tagged # Inline, not inside download-dists: nesting this Docker action in a