Pin SLSA verifier to tag version

marcransome · Mar 24, 2024 · 3c491c1 · 3c491c1
1 parent a1bfcc5
commit 3c491c1
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -123,7 +123,7 @@ jobs:
         with:
           name: ${{ needs.build.outputs.sha256-filename-darwin-arm64 }}
       - name: Install SLSA verifier
-        uses: slsa-framework/slsa-verifier/actions/installer@7e1e47d7d793930ab0082c15c2b971fdb53a3c95 # v2.4.1
+        uses: slsa-framework/slsa-verifier/actions/[email protected] # Must specify version tag; see https://github.com/slsa-framework/slsa-verifier/issues/12
       - name: Verify SLSA provenance
         env:
           CHECKSUMS: ${{ needs.combine-checksums.outputs.checksums }}