From 8de4116bdb2b67a8f14840c7d0756b1a1bfb382a Mon Sep 17 00:00:00 2001 From: Robert Allen Date: Mon, 22 Jun 2026 19:51:27 -0400 Subject: [PATCH] chore(catalog): re-pin shared verify action to merged .github main Point catalog-admission's verify step at the merged attested-delivery/.github main SHA (b74df46), which includes the engine fixes from .github #16 and #17. Replaces the transient pin to #16's branch commit. --- .github/workflows/catalog-admission.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/catalog-admission.yml b/.github/workflows/catalog-admission.yml index e8883ba..dffd170 100644 --- a/.github/workflows/catalog-admission.yml +++ b/.github/workflows/catalog-admission.yml @@ -75,10 +75,8 @@ jobs: # with the central catalog-updater hub so "what must verify for an external # entry" lives in one place. No external entries yet (v1 vendors its only # plugin), so this is a clean no-op until the catalog grows. - # Pinned to attested-delivery/.github PR #16's branch commit; re-pin to the - # merged main SHA when #16 merges (cf. the bootstrap note in README.md). - name: Verify external entries' attestations (shared, fail-closed) - uses: attested-delivery/.github/.github/actions/plugin-catalog-update@21ac2e25a3a92a37e4225351c389d39868b77959 # .github#16 + uses: attested-delivery/.github/.github/actions/plugin-catalog-update@b74df46cd6e64777bd557a41c6f75a933cbc9617 # .github main with: mode: verify repo: ${{ github.repository }}