From fe3e096db16a4152fd1b2e585c2df9ee85a7d128 Mon Sep 17 00:00:00 2001 From: harden-bot Date: Mon, 22 Jun 2026 12:11:19 -0700 Subject: [PATCH] fix(ci): correct goreleaser-action version pin comment (v2.8.1 -> v6.2.1) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The goreleaser/goreleaser-action step in release.yaml is pinned to 90a3faa9d0182683851fbfa97ca1a2cb983bfca3, which resolves to v6.2.1 (verified against the upstream tags) — but the comment claimed `# v2.8.1`, understating the action by four major versions. Correct the comment to match the pinned commit. SHA unchanged; behavior unchanged (ref-version-mismatch / provenance accuracy only). Refs: PSEC-923 Co-Authored-By: Steve Beattie --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index d271254..5fd12de 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -41,7 +41,7 @@ jobs: - uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1 - - uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v2.8.1 + - uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v6.2.1 with: install-only: true