Microsoft/vscode
1
0
Fork 0
mirror of https://github.com/microsoft/vscode.git synced 2026-08-14 09:45:55 +01:00
Code Issues Packages Projects Releases Wiki Activity

Pin GitHub Actions to full-length commit SHAs (#329034)

Browse Source 
* Pin GitHub Actions to full-length commit SHAs

* chore: attest to third-party action pinning changes

I have reviewed the action-pinning diff authored by OssSecurityBot and
verified that each pinned SHA resolves to the same commit the tag it
replaces pointed at, and that no workflow logic was altered beyond the
`uses:` references.

This commit is signed with my key from security/trusted-signing-keys.csv
so the attestation is bound to my identity and to this exact tree. Any
subsequent push replaces the head and invalidates it.

Refs #328868

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: OssSecurityBot <oss-security-bot@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Michael Lively
2026-08-06 11:22:51 +02:00
committed by GitHub
co-authored by OssSecurityBot Copilot
parent 013dedfebf
commit e4124f7635
17 changed files with 99 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/pr-linux-cli-test.yml
+1 -1
View File
@@ -16,7 +16,7 @@ jobs:
RUSTUP_TOOLCHAIN: ${{ inputs.rustup_toolchain }}
steps:
- name: Checkout microsoft/vscode
uses: actions/checkout@v6
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
lfs: true