From 0f465687c43b4af909164083a2c210c055c1712d Mon Sep 17 00:00:00 2001 From: James Maes Date: Mon, 12 Oct 2026 09:58:35 -0500 Subject: [PATCH] fix(signing): pin reviewed helpers reachable from main After squash merge, online zizmor correctly rejects the former branch-only helper commit as an impostor. Repin all six calls to the signed main merge commit containing byte-identical reviewed helpers. The actual online gate reproduces six HIGH findings before the change and passes afterward; actionlint passes. No helper behavior, security rule or suppression changes. Co-Authored-By: Codex (GPT-6) Signed-off-by: James Maes --- .github/workflows/release-nuget.yml | 6 +++--- .github/workflows/release-velopack.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release-nuget.yml b/.github/workflows/release-nuget.yml index 667c9a2..116f107 100644 --- a/.github/workflows/release-nuget.yml +++ b/.github/workflows/release-nuget.yml @@ -199,7 +199,7 @@ jobs: - name: Prepare owned binary signing catalog if: inputs.sign id: signing - uses: KofTwentyTwo/standards/.github/actions/windows-signing@3334d02b907d44f4dca1b32553ad2bd6203c7b7f # unreleased signing helpers + uses: KofTwentyTwo/standards/.github/actions/windows-signing@f896215ec96854b18883191759259fd9866ee9be # reviewed signing helpers on main with: operation: prepare signing-files: ${{ inputs.signing-files }} @@ -255,7 +255,7 @@ jobs: - name: Verify signed binaries if: inputs.sign - uses: KofTwentyTwo/standards/.github/actions/windows-signing@3334d02b907d44f4dca1b32553ad2bd6203c7b7f # unreleased signing helpers + uses: KofTwentyTwo/standards/.github/actions/windows-signing@f896215ec96854b18883191759259fd9866ee9be # reviewed signing helpers on main with: operation: verify manifest: ${{ steps.signing.outputs.manifest }} @@ -269,7 +269,7 @@ jobs: - name: Verify the exact binaries shipped in NuGet packages if: inputs.sign - uses: KofTwentyTwo/standards/.github/actions/windows-signing@3334d02b907d44f4dca1b32553ad2bd6203c7b7f # unreleased signing helpers + uses: KofTwentyTwo/standards/.github/actions/windows-signing@f896215ec96854b18883191759259fd9866ee9be # reviewed signing helpers on main with: operation: verify-distribution directory: artifacts/nuget diff --git a/.github/workflows/release-velopack.yml b/.github/workflows/release-velopack.yml index 0036391..618b5aa 100644 --- a/.github/workflows/release-velopack.yml +++ b/.github/workflows/release-velopack.yml @@ -333,7 +333,7 @@ jobs: - name: Prepare owned binary signing catalog if: inputs.sign id: signing - uses: KofTwentyTwo/standards/.github/actions/windows-signing@3334d02b907d44f4dca1b32553ad2bd6203c7b7f # unreleased signing helpers + uses: KofTwentyTwo/standards/.github/actions/windows-signing@f896215ec96854b18883191759259fd9866ee9be # reviewed signing helpers on main with: operation: prepare root: publish @@ -395,7 +395,7 @@ jobs: - name: Verify signed binaries and preserved dependencies if: inputs.sign - uses: KofTwentyTwo/standards/.github/actions/windows-signing@3334d02b907d44f4dca1b32553ad2bd6203c7b7f # unreleased signing helpers + uses: KofTwentyTwo/standards/.github/actions/windows-signing@f896215ec96854b18883191759259fd9866ee9be # reviewed signing helpers on main with: operation: verify manifest: ${{ steps.signing.outputs.manifest }} @@ -510,7 +510,7 @@ jobs: - name: Verify final installer, portable, full update and CLI assets if: inputs.sign - uses: KofTwentyTwo/standards/.github/actions/windows-signing@3334d02b907d44f4dca1b32553ad2bd6203c7b7f # unreleased signing helpers + uses: KofTwentyTwo/standards/.github/actions/windows-signing@f896215ec96854b18883191759259fd9866ee9be # reviewed signing helpers on main with: operation: verify-distribution directory: release -- 2.54.0