From 1d3cd491111d710801c6e4ad0aed18ee031f7e38 Mon Sep 17 00:00:00 2001 From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com> Date: Fri, 13 Nov 2026 15:10:58 +0000 Subject: [PATCH] Pin native workflow policy to accepted response-loss source --- .github/workflows/native-policy.yml | 2 +- tests/test_native_policy_workflow.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/native-policy.yml b/.github/workflows/native-policy.yml index 82613fd..a781af4 100644 --- a/.github/workflows/native-policy.yml +++ b/.github/workflows/native-policy.yml @@ -19,7 +19,7 @@ jobs: uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6 with: repository: durable-workflow/.github - ref: b7da972634348e9bb27ff3653c383e93965ce043 + ref: d4770e6555fdb59b044f2e5919e95a24c0a25073 path: .native-policy-control persist-credentials: false - name: Set up the policy interpreter diff --git a/tests/test_native_policy_workflow.py b/tests/test_native_policy_workflow.py index 4b7e8cc..93c5d48 100644 --- a/tests/test_native_policy_workflow.py +++ b/tests/test_native_policy_workflow.py @@ -24,7 +24,7 @@ def test_only_central_pinned_code_is_checked_out_without_persisted_credentials(s self.assertEqual(1, len(checkouts)) settings = checkouts[0]["with"] self.assertEqual("durable-workflow/.github", settings["repository"]) - self.assertRegex(settings["ref"], r"^[0-9a-f]{40}$") + self.assertEqual("d4770e6555fdb59b044f2e5919e95a24c0a25073", settings["ref"]) self.assertIs(False, settings["persist-credentials"]) self.assertEqual(".native-policy-control", settings["path"])