coffee/fmt
1
0
Fork 0
mirror of https://github.com/fmtlib/fmt.git synced 2026-11-09 14:50:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

Document why the SLSA generator is referenced by tag

Browse Source 
Scorecard flags the tag as an unpinned dependency, but the generator
doesn't support being pinned by hash.
This commit is contained in:
Victor Zverovich 2026-11-07 09:30:31 -08:00
parent 31a44d5a83
commit 24ab1de71c
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/release.yml vendored
View File

@ -116,6 +116,8 @@ jobs:
# upload-assets job declares it, and a reusable workflow's job
# permissions may not exceed the caller's, or the run fails at startup.
contents: write
# The generator must be referenced by an exact vX.Y.Z tag rather than
# pinned by hash, or slsa-verifier can't verify the generator's ref.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
with:
base64-subjects: ${{ needs.build.outputs.hashes }}