mirror of
https://github.com/microsoft/vscode.git
synced 2026-08-14 17:54:53 +01:00
e4124f7635
* Pin GitHub Actions to full-length commit SHAs * chore: attest to third-party action pinning changes I have reviewed the action-pinning diff authored by OssSecurityBot and verified that each pinned SHA resolves to the same commit the tag it replaces pointed at, and that no workflow logic was altered beyond the `uses:` references. This commit is signed with my key from security/trusted-signing-keys.csv so the attestation is bound to my identity and to this exact tree. Any subsequent push replaces the head and invalidates it. Refs #328868 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: OssSecurityBot <oss-security-bot@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>