fix(signing): pin reviewed helpers reachable from main #39

2026-10-12T14:59:12Z

KofTwentyTwo commented

2026-10-12 14:59:12 +00:00

(Migrated from github.com)

After PR #31 was squash-merged, its former branch-only helper SHA lost repository ancestry. Main CI correctly rejects all six helper references with HIGH impostor-commit findings and blocks the standards release proposal.

This changes exactly six full-SHA references in the NuGet and Velopack builders to the verified signed merge commit on main. Both the composite action and its helper module are byte-identical to the version reviewed in PR #31. No signing implementation, permissions, guards or suppressions change.

Validation: actual online zizmor 1.30.1 reproduces six HIGH findings before the fix (exit 14) and passes after it (exit 0); actionlint 1.7.12 and diff hygiene pass. Logs are retained locally. Required hosted checks remain mandatory. This PR unblocks the reviewed builder publication needed by MarkdownViewr; it does not claim protected CI signing or production application release.

Substantial assistance: Codex (GPT-6). Signed/DCO commit. Follow-up to #31.

After PR #31 was squash-merged, its former branch-only helper SHA lost repository ancestry. Main CI correctly rejects all six helper references with HIGH `impostor-commit` findings and blocks the standards release proposal. This changes exactly six full-SHA references in the NuGet and Velopack builders to the verified signed merge commit on main. Both the composite action and its helper module are byte-identical to the version reviewed in PR #31. No signing implementation, permissions, guards or suppressions change. Validation: actual online zizmor 1.30.1 reproduces six HIGH findings before the fix (exit 14) and passes after it (exit 0); actionlint 1.7.12 and diff hygiene pass. Logs are retained locally. Required hosted checks remain mandatory. This PR unblocks the reviewed builder publication needed by MarkdownViewr; it does not claim protected CI signing or production application release. Substantial assistance: Codex (GPT-6). Signed/DCO commit. Follow-up to #31.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#39