From 1b168dbb2d65ab2aa2aea5d4bc05fcb149a5c0a0 Mon Sep 17 00:00:00 2001 From: James Maes Date: Sat, 10 Oct 2026 16:07:19 -0500 Subject: [PATCH] ci(release): re-pin the shared Velopack workflow to the signing fix standards#29 (40ecebae) signs only the binaries without a valid signature, drives vpk signing through a SignTool wrapper and verifies every packaged executable before the draft release; v1.0.2-beta.2 had timed out signing already-signed runtime files. Closes #97 Co-Authored-By: Claude Fable 5.1 Signed-off-by: James Maes --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c189266..2334c67 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -145,7 +145,7 @@ jobs: release: name: Release needs: [verify, gates, smoke] - uses: KofTwentyTwo/standards/.github/workflows/release-velopack.yml@e8ab30f8c60df437440ffd786c87678207246f5c # main 2026-10-09 (pre-1.0 draft, standards#5) + uses: KofTwentyTwo/standards/.github/workflows/release-velopack.yml@40ecebae5c32d5550afb4af157eee69572bd267a # main 2026-10-10 (signs only unsigned binaries, standards#29) permissions: contents: write # create and publish the GitHub release id-token: write # sign attestations; Azure OIDC when signing -- 2.54.0