From 24ab1de71c23dcefcb41e9f74ba12f0e43a8afba Mon Sep 17 00:00:00 2001 From: Victor Zverovich Date: Sat, 7 Nov 2026 09:30:31 -0800 Subject: [PATCH] Document why the SLSA generator is referenced by tag Scorecard flags the tag as an unpinned dependency, but the generator doesn't support being pinned by hash. --- .github/workflows/release.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 30ae7b22..c6511169 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -116,6 +116,8 @@ jobs: # upload-assets job declares it, and a reusable workflow's job # permissions may not exceed the caller's, or the run fails at startup. contents: write + # The generator must be referenced by an exact vX.Y.Z tag rather than + # pinned by hash, or slsa-verifier can't verify the generator's ref. uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 with: base64-subjects: ${{ needs.build.outputs.hashes }}