Skip to content

Commit bf2b4d1

Browse files
ramonpetgrave64ramonpetgrave64
authored
Merge branch 'main' into dependabot/go_modules/go_modules-403cefacee
2 parents d13f6fb + 491ff0a commit bf2b4d1

37 files changed

+111
-111
lines changed

‎.github/actions/generate-builder/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ runs:
7676
token: ${{ inputs.token }}
7777

7878
- name: Set up Go environment
79-
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
79+
uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
8080
with:
8181
go-version: ${{ inputs.go-version }}
8282

‎.github/actions/secure-builder-checkout/action.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ runs:
3737
# and has an associated release. This will require exceptions
3838
# for e2e tests.
3939
- name: Checkout the repository
40-
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
40+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4141
with:
4242
repository: ${{ inputs.repository }}
4343
ref: ${{ inputs.ref }}

‎.github/actions/secure-project-checkout-go/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ runs:
6565
fi
6666
6767
- name: Set up Go environment
68-
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
68+
uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
6969
with:
7070
go-version: ${{ steps.validate.outputs.go_version }}
7171
go-version-file: ${{ steps.validate.outputs.go_version_file }}

‎.github/actions/secure-project-checkout-node/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,6 @@ runs:
4141
path: ${{ inputs.path }}
4242

4343
- name: Set up Node environment
44-
uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
44+
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
4545
with:
4646
node-version: ${{ inputs.node-version }}

‎.github/actions/secure-project-checkout/action.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ runs:
4040
using: "composite"
4141
steps:
4242
- name: Checkout the repository
43-
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
43+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4444
with:
4545
fetch-depth: ${{ inputs.fetch-depth }}
4646
ref: ${{ inputs.checkout-sha1 }}

‎.github/actions/secure-upload-artifact/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ runs:
3737
path: "${{ inputs.path }}"
3838

3939
- name: Upload the artifact
40-
uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
40+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
4141
with:
4242
name: "${{ inputs.name }}"
4343
path: "${{ inputs.path }}"

‎.github/workflows/builder_container-based_slsa3.yml

+12-12
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ jobs:
209209
allow-private-repository: ${{ inputs.rekor-log-public }}
210210

211211
- name: Upload builder
212-
uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
212+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
213213
with:
214214
name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}"
215215
path: "${{ env.BUILDER_BINARY }}"
@@ -228,7 +228,7 @@ jobs:
228228
runs-on: ubuntu-latest
229229
needs: [rng, detect-env, generate-builder]
230230
steps:
231-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
231+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
232232
- name: Checkout builder repository
233233
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
234234
with:
@@ -306,7 +306,7 @@ jobs:
306306
- id: auth
307307
name: Authenticate to Google Cloud
308308
if: inputs.gcp-workload-identity-provider != ''
309-
uses: google-github-actions/auth@71fee32a0bb7e97b4d33d548e7d957010649d8fa # v2.1.3
309+
uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
310310
with:
311311
token_format: "access_token"
312312
workload_identity_provider: ${{ inputs.gcp-workload-identity-provider }}
@@ -372,7 +372,7 @@ jobs:
372372
set-executable: true
373373

374374
- name: Checkout the source repository
375-
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
375+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
376376
with:
377377
fetch-depth: 1
378378
persist-credentials: false
@@ -462,7 +462,7 @@ jobs:
462462
# TODO(https://github.com/slsa-framework/slsa-github-generator/issues/1655): Use a
463463
# secure upload or verify this against the SLSA layout file.
464464
id: upload-artifacts
465-
uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
465+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
466466
with:
467467
name: ${{ steps.build.outputs.build-outputs-name }}
468468
path: /tmp/build-outputs-${{ needs.rng.outputs.value }}
@@ -535,7 +535,7 @@ jobs:
535535
- name: Upload unsigned intoto attestations file for pull request
536536
if: ${{ github.event_name == 'pull_request' }}
537537
id: upload-unsigned
538-
uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
538+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
539539
with:
540540
name: "${{ env.OUTPUT_FOLDER }}-${{ needs.rng.outputs.value }}"
541541
path: "attestations-${{ needs.rng.outputs.value }}"
@@ -556,7 +556,7 @@ jobs:
556556
- name: Upload the signed attestations
557557
id: upload-signed
558558
if: ${{ github.event_name != 'pull_request' }}
559-
uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
559+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
560560
with:
561561
name: "${{ env.OUTPUT_FOLDER }}-${{ needs.rng.outputs.value }}"
562562
path: "${{ env.OUTPUT_FOLDER }}-${{ needs.rng.outputs.value }}"
@@ -598,7 +598,7 @@ jobs:
598598
path: "${{ needs.provenance.outputs.provenance-name }}"
599599

600600
- name: Upload provenance new tag
601-
uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
601+
uses: softprops/action-gh-release@7b4da11513bf3f43f9999e90eabced41ab8bb048 # v2.2.0
602602
if: startsWith(github.ref, 'refs/tags/') && inputs.upload-tag-name == ''
603603
id: release-new-tags
604604
with:
@@ -609,7 +609,7 @@ jobs:
609609
draft: ${{ inputs.draft-release }}
610610

611611
- name: Upload provenance tag name
612-
uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
612+
uses: softprops/action-gh-release@7b4da11513bf3f43f9999e90eabced41ab8bb048 # v2.2.0
613613
if: inputs.upload-tag-name != ''
614614
with:
615615
prerelease: ${{ inputs.prerelease }}
@@ -633,13 +633,13 @@ jobs:
633633
SLSA_OUTPUTS_NAME: ${{ needs.build.outputs.slsa-outputs-name }}
634634
RNG: ${{ needs.rng.outputs.value }}
635635
steps:
636-
- uses: geekyeggo/delete-artifact@24928e75e6e6590170563b8ddae9fac674508aa1 # v5.0.0
636+
- uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
637637
with:
638638
name: "${{ env.BUILD_DEFINITION_NAME }}-${{ env.RNG }}"
639639
useGlob: true
640-
- uses: geekyeggo/delete-artifact@24928e75e6e6590170563b8ddae9fac674508aa1 # v5.0.0
640+
- uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
641641
with:
642642
name: "${{ env.SLSA_OUTPUTS_NAME }}-${{ env.RNG }}"
643-
- uses: geekyeggo/delete-artifact@24928e75e6e6590170563b8ddae9fac674508aa1 # v5.0.0
643+
- uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
644644
with:
645645
name: "${{ env.BUILDER_BINARY }}-${{ env.RNG }}"

‎.github/workflows/builder_go_slsa3.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,7 @@ jobs:
169169
allow-private-repository: ${{ inputs.private-repository }}
170170

171171
- name: Upload builder
172-
uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
172+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
173173
with:
174174
name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}"
175175
path: "${{ env.BUILDER_BINARY }}"
@@ -358,7 +358,7 @@ jobs:
358358
--workingDir "$UNTRUSTED_WORKING_DIR"
359359
360360
- name: Upload the signed provenance
361-
uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
361+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
362362
with:
363363
name: "${{ steps.sign-prov.outputs.signed-provenance-name }}"
364364
path: "${{ steps.sign-prov.outputs.signed-provenance-name }}"
@@ -399,7 +399,7 @@ jobs:
399399
sha256: "${{ needs.provenance.outputs.go-provenance-sha256 }}"
400400

401401
- name: Upload provenance
402-
uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
402+
uses: softprops/action-gh-release@7b4da11513bf3f43f9999e90eabced41ab8bb048 # v2.2.0
403403
with:
404404
tag_name: ${{ inputs.upload-tag-name }}
405405
prerelease: ${{ inputs.prerelease }}

‎.github/workflows/codeql-analysis.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,11 @@ jobs:
5555

5656
steps:
5757
- name: Checkout repository
58-
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
58+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5959

6060
# Initializes the CodeQL tools for scanning.
6161
- name: Initialize CodeQL
62-
uses: github/codeql-action/init@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3.25.15
62+
uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
6363
with:
6464
languages: ${{ matrix.language }}
6565
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -72,7 +72,7 @@ jobs:
7272
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
7373
# If this step fails, then you should remove it and run the build manually (see below)
7474
- name: Autobuild
75-
uses: github/codeql-action/autobuild@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3.25.15
75+
uses: github/codeql-action/autobuild@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
7676

7777
# Command-line programs to run using the OS shell.
7878
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -85,7 +85,7 @@ jobs:
8585
# ./location_of_script_within_repo/buildscript.sh
8686

8787
- name: Perform CodeQL Analysis
88-
uses: github/codeql-action/analyze@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a # v3.25.15
88+
uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
8989

9090
# NOTE: Checks that the matrix job above completes successfully.
9191
# This is necessary because the matrix strategy generates new jobs with

‎.github/workflows/delegator_generic_slsa3.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -294,9 +294,9 @@ jobs:
294294
env:
295295
RNG: ${{ needs.rng.outputs.value }}
296296
steps:
297-
- uses: geekyeggo/delete-artifact@24928e75e6e6590170563b8ddae9fac674508aa1 # v5.0.0
297+
- uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
298298
with:
299299
name: "${{ env.RNG }}-${{ env.SLSA_PREDICATE_FILE }}"
300-
- uses: geekyeggo/delete-artifact@24928e75e6e6590170563b8ddae9fac674508aa1 # v5.0.0
300+
- uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
301301
with:
302302
name: "${{ env.RNG }}-${{ env.SLSA_ARTIFACTS_FILE }}"

‎.github/workflows/delegator_lowperms-generic_slsa3.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -297,9 +297,9 @@ jobs:
297297
env:
298298
RNG: ${{ needs.rng.outputs.value }}
299299
steps:
300-
- uses: geekyeggo/delete-artifact@24928e75e6e6590170563b8ddae9fac674508aa1 # v5.0.0
300+
- uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
301301
with:
302302
name: "${{ env.RNG }}-${{ env.SLSA_PREDICATE_FILE }}"
303-
- uses: geekyeggo/delete-artifact@24928e75e6e6590170563b8ddae9fac674508aa1 # v5.0.0
303+
- uses: geekyeggo/delete-artifact@f275313e70c08f6120db482d7a6b98377786765b # v5.1.0
304304
with:
305305
name: "${{ env.RNG }}-${{ env.SLSA_ARTIFACTS_FILE }}"

‎.github/workflows/e2e.create-container_based-predicate.schedule.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
permissions:
4040
id-token: write # Needed to detect the current reusable repository and ref.
4141
steps:
42-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
42+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4343
- name: Detect the builder ref
4444
id: detect
4545
uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@main
@@ -71,7 +71,7 @@ jobs:
7171
contents: read
7272
issues: write
7373
steps:
74-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
74+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7575
with:
7676
repository: slsa-framework/example-package
7777
ref: main
@@ -85,7 +85,7 @@ jobs:
8585
contents: read
8686
issues: write
8787
steps:
88-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
88+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8989
with:
9090
repository: slsa-framework/example-package
9191
ref: main

‎.github/workflows/e2e.detect-workflow-js.schedule.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
id-token: write
3434
runs-on: ubuntu-latest
3535
steps:
36-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
36+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3737
- id: detect
3838
uses: ./.github/actions/detect-workflow-js
3939
- id: verify
@@ -70,7 +70,7 @@ jobs:
7070
contents: read
7171
issues: write
7272
steps:
73-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
73+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7474
with:
7575
repository: slsa-framework/example-package
7676
ref: main
@@ -84,7 +84,7 @@ jobs:
8484
contents: read
8585
issues: write
8686
steps:
87-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
87+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8888
with:
8989
repository: slsa-framework/example-package
9090
ref: main

‎.github/workflows/e2e.sign-attestations.schedule.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,14 @@ jobs:
3333
id-token: write
3434
runs-on: ubuntu-latest
3535
steps:
36-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
36+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3737
- id: setup
3838
uses: ./.github/actions/sign-attestations
3939
with:
4040
attestations: .github/actions/sign-attestations/testdata/attestations
4141
output-folder: outputs
4242
- name: Setup node
43-
uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4
43+
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
4444
with:
4545
node-version: 20
4646
- name: install sigstore-js
@@ -62,7 +62,7 @@ jobs:
6262
contents: read
6363
issues: write
6464
steps:
65-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
65+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6666
with:
6767
repository: slsa-framework/example-package
6868
ref: main
@@ -76,7 +76,7 @@ jobs:
7676
contents: read
7777
issues: write
7878
steps:
79-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
79+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
8080
with:
8181
repository: slsa-framework/example-package
8282
ref: main

‎.github/workflows/e2e.upload-folder.schedule.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
sha256: ${{ steps.upload.outputs.sha256 }}
3838
sha256-noroot: ${{ steps.upload-noroot.outputs.sha256 }}
3939
steps:
40-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
40+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4141
- name: Create folder
4242
run: |
4343
set -euo pipefail
@@ -100,7 +100,7 @@ jobs:
100100
needs: [secure-upload-folder]
101101
runs-on: ubuntu-latest
102102
steps:
103-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
103+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
104104

105105
- name: Download in new folder
106106
uses: ./.github/actions/secure-download-folder
@@ -180,7 +180,7 @@ jobs:
180180
contents: read
181181
issues: write
182182
steps:
183-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
183+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
184184
with:
185185
repository: slsa-framework/example-package
186186
ref: main
@@ -194,7 +194,7 @@ jobs:
194194
contents: read
195195
issues: write
196196
steps:
197-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
197+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
198198
with:
199199
repository: slsa-framework/example-package
200200
ref: main

‎.github/workflows/generator_container_slsa3.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -158,14 +158,14 @@ jobs:
158158
- id: auth
159159
name: Authenticate to Google Cloud
160160
if: inputs.gcp-workload-identity-provider != ''
161-
uses: google-github-actions/auth@71fee32a0bb7e97b4d33d548e7d957010649d8fa # v2.1.3
161+
uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
162162
with:
163163
token_format: "access_token"
164164
workload_identity_provider: ${{ inputs.gcp-workload-identity-provider }}
165165
service_account: ${{ inputs.gcp-service-account }}
166166

167167
- id: cosign-install
168-
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
168+
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
169169
with:
170170
cosign-release: v2.2.3
171171
continue-on-error: true

‎.github/workflows/generator_generic_slsa3.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,7 @@ jobs:
239239
- name: Upload the signed provenance
240240
id: upload-prov
241241
continue-on-error: true
242-
uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
242+
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
243243
with:
244244
name: "${{ steps.sign-prov.outputs.provenance-name }}"
245245
path: "${{ steps.sign-prov.outputs.provenance-name }}"
@@ -285,7 +285,7 @@ jobs:
285285
sha256: "${{ needs.generator.outputs.provenance-sha256 }}"
286286

287287
- name: Upload provenance
288-
uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
288+
uses: softprops/action-gh-release@7b4da11513bf3f43f9999e90eabced41ab8bb048 # v2.2.0
289289
id: release
290290
with:
291291
draft: ${{ inputs.draft-release }}

0 commit comments

Comments
 (0)