pin actions/attest reference by commit sha (#493)
Some checks failed
Check Transpiled JavaScript / Check dist/ (push) Failing after 2s
Continuous Integration / TypeScript Tests (push) Failing after 1s
Continuous Integration / Test attest-provenance action (push) Failing after 3s
Lint Codebase / Lint Codebase (push) Failing after 1s
CodeQL / Analyze (TypeScript) (push) Failing after 1s
Public-Good Sigstore Prober / prober (push) Failing after 1s
GitHub Sigstore Prober / prober (push) Failing after 1s

Signed-off-by: Brian DeHamer <bdehamer@github.com>
This commit is contained in:
Brian DeHamer 2025-03-05 11:07:49 -08:00 committed by GitHub
parent bd77c07785
commit c074443f1a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

View File

@ -64,7 +64,7 @@ runs:
steps:
- uses: actions/attest-build-provenance/predicate@1176ef556905f349f669722abf30bce1a6e16e01 # predicate@1.1.5
id: generate-build-provenance-predicate
- uses: actions/attest@v2.2.1
- uses: actions/attest@a63cfcc7d1aab266ee064c58250cfc2c7d07bc31 # v2.2.1
id: attest
with:
subject-path: ${{ inputs.subject-path }}