Merge pull request #141 from marcransome/release-workflow-verify-prov…

…enance-fix Pin SLSA verifier to tag version
marcransome · Mar 24, 2024 · b6c01a8 · b6c01a8
2 parents a1bfcc5 + 3c491c1
commit b6c01a8
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -123,7 +123,7 @@ jobs:
         with:
           name: ${{ needs.build.outputs.sha256-filename-darwin-arm64 }}
       - name: Install SLSA verifier
-        uses: slsa-framework/slsa-verifier/actions/installer@7e1e47d7d793930ab0082c15c2b971fdb53a3c95 # v2.4.1
+        uses: slsa-framework/slsa-verifier/actions/[email protected] # Must specify version tag; see https://github.com/slsa-framework/slsa-verifier/issues/12
       - name: Verify SLSA provenance
         env:
           CHECKSUMS: ${{ needs.combine-checksums.outputs.checksums }}