From fa192be070c17798b2f1abb37e314ca78ae93f2d Mon Sep 17 00:00:00 2001 From: Stefan Fleckenstein Date: Thu, 2 Jul 2026 08:22:45 +0100 Subject: [PATCH] chore: pin slsa action --- template/.github/workflows/build.yaml.j2 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/template/.github/workflows/build.yaml.j2 b/template/.github/workflows/build.yaml.j2 index de1ca64f..dd13c589 100644 --- a/template/.github/workflows/build.yaml.j2 +++ b/template/.github/workflows/build.yaml.j2 @@ -254,7 +254,7 @@ jobs: packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved # MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the reusable # workflow cannot verify its own provenance. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 with: # The 'env' context is not available in job-level 'with' inputs of # reusable workflow calls (unlike step-level 'with'), so OPERATOR_NAME @@ -281,7 +281,7 @@ jobs: packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved # MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the reusable # workflow cannot verify its own provenance. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 with: # The 'env' context is not available in job-level 'with' inputs of # reusable workflow calls (unlike step-level 'with'), so OPERATOR_NAME