From a5e07408d286effb307dc4a8103ef5f8991b38fb Mon Sep 17 00:00:00 2001 From: Robert Allen Date: Mon, 22 Jun 2026 22:28:41 -0400 Subject: [PATCH] chore(ci): pin attested-delivery/.github reusables to v0.1.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Re-pin all .github reusable-workflow and action references (quality-gates, ci, release, catalog-admission) to the v0.1.0 release SHA f211de9, with # v0.1.0 labels — the marketplace now tracks the first tagged release of the central catalog instead of intermediate commits. --- .github/workflows/catalog-admission.yml | 2 +- .github/workflows/ci.yml | 4 ++-- .github/workflows/quality-gates.yml | 16 ++++++------- .github/workflows/release.yml | 32 ++++++++++++------------- 4 files changed, 27 insertions(+), 27 deletions(-) diff --git a/.github/workflows/catalog-admission.yml b/.github/workflows/catalog-admission.yml index dffd170..db96dcd 100644 --- a/.github/workflows/catalog-admission.yml +++ b/.github/workflows/catalog-admission.yml @@ -76,7 +76,7 @@ jobs: # entry" lives in one place. No external entries yet (v1 vendors its only # plugin), so this is a clean no-op until the catalog grows. - name: Verify external entries' attestations (shared, fail-closed) - uses: attested-delivery/.github/.github/actions/plugin-catalog-update@b74df46cd6e64777bd557a41c6f75a933cbc9617 # .github main + uses: attested-delivery/.github/.github/actions/plugin-catalog-update@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: mode: verify repo: ${{ github.repository }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 37da418..afcffe4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -26,7 +26,7 @@ jobs: permissions: contents: read uses: >- - attested-delivery/.github/.github/workflows/pin-check.yml@aba1860be6b6ebd5c0c0a0f07160946fb0349965 + attested-delivery/.github/.github/workflows/pin-check.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 # Centralized, verified actionlint fetch. # attested-delivery/.github @ b314c29 (#6 — in-step PATH fix) @@ -34,4 +34,4 @@ jobs: permissions: contents: read uses: >- - attested-delivery/.github/.github/workflows/reusable-actionlint.yml@b314c29ac9d445ea1f6ad5487743a909e104ceb9 + attested-delivery/.github/.github/workflows/reusable-actionlint.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml index b356031..7993641 100644 --- a/.github/workflows/quality-gates.yml +++ b/.github/workflows/quality-gates.yml @@ -40,7 +40,7 @@ jobs: actions: read packages: read uses: >- - attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: languages: actions build-mode: none @@ -52,7 +52,7 @@ jobs: security-events: write pull-requests: write uses: >- - attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: fail-on-severity: high @@ -63,7 +63,7 @@ jobs: actions: read packages: read uses: >- - attested-delivery/.github/.github/workflows/reusable-trivy.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-trivy.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: scan-iac: true @@ -75,7 +75,7 @@ jobs: contents: read actions: read uses: >- - attested-delivery/.github/.github/workflows/reusable-scorecard.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-scorecard.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: publish-results: false @@ -85,7 +85,7 @@ jobs: contents: read security-events: write uses: >- - attested-delivery/.github/.github/workflows/reusable-shellcheck.yml@b26631596d8dcac18c6b92d436f676be5bf1d97c + attested-delivery/.github/.github/workflows/reusable-shellcheck.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 semgrep: permissions: @@ -93,7 +93,7 @@ jobs: security-events: write actions: read uses: >- - attested-delivery/.github/.github/workflows/reusable-semgrep.yml@b26631596d8dcac18c6b92d436f676be5bf1d97c + attested-delivery/.github/.github/workflows/reusable-semgrep.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: directory: . @@ -103,7 +103,7 @@ jobs: security-events: write actions: read uses: >- - attested-delivery/.github/.github/workflows/reusable-secrets.yml@b26631596d8dcac18c6b92d436f676be5bf1d97c + attested-delivery/.github/.github/workflows/reusable-secrets.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: directory: . @@ -113,7 +113,7 @@ jobs: security-events: write actions: read uses: >- - attested-delivery/.github/.github/workflows/reusable-manifest-review.yml@b26631596d8dcac18c6b92d436f676be5bf1d97c + attested-delivery/.github/.github/workflows/reusable-manifest-review.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: directory: . diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ab7868c..ff096a9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -137,47 +137,47 @@ jobs: needs: [meta] permissions: { security-events: write, contents: read, actions: read, packages: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: { languages: actions, build-mode: none } gate-sca: needs: [meta] permissions: { actions: read, contents: read, security-events: write, pull-requests: write } uses: >- - attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: { fail-on-severity: high } gate-trivy: needs: [meta] permissions: { contents: read, security-events: write, actions: read, packages: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-trivy.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-trivy.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: { scan-iac: true } gate-shellcheck: needs: [meta] permissions: { contents: read, security-events: write } uses: >- - attested-delivery/.github/.github/workflows/reusable-shellcheck.yml@b26631596d8dcac18c6b92d436f676be5bf1d97c + attested-delivery/.github/.github/workflows/reusable-shellcheck.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 gate-semgrep: needs: [meta] permissions: { contents: read, security-events: write, actions: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-semgrep.yml@b26631596d8dcac18c6b92d436f676be5bf1d97c + attested-delivery/.github/.github/workflows/reusable-semgrep.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 gate-secrets: needs: [meta] permissions: { contents: read, security-events: write, actions: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-secrets.yml@b26631596d8dcac18c6b92d436f676be5bf1d97c + attested-delivery/.github/.github/workflows/reusable-secrets.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 gate-manifest: needs: [meta] permissions: { contents: read, security-events: write, actions: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-manifest-review.yml@b26631596d8dcac18c6b92d436f676be5bf1d97c + attested-delivery/.github/.github/workflows/reusable-manifest-review.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 # --- seam attestations: bind each verdict to the tarball digest ------------- attest-sast: needs: [meta, build, gate-sast] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -188,7 +188,7 @@ jobs: needs: [meta, build, gate-sca] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -199,7 +199,7 @@ jobs: needs: [meta, build, gate-trivy] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -210,7 +210,7 @@ jobs: needs: [meta, build, gate-shellcheck] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -221,7 +221,7 @@ jobs: needs: [meta, build, gate-semgrep] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -232,7 +232,7 @@ jobs: needs: [meta, build, gate-secrets] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -243,7 +243,7 @@ jobs: needs: [meta, build, gate-manifest] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }} @@ -256,7 +256,7 @@ jobs: needs: [meta] permissions: { id-token: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-cosign-sign.yml@b26631596d8dcac18c6b92d436f676be5bf1d97c + attested-delivery/.github/.github/workflows/reusable-cosign-sign.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: blob-path: .claude-plugin/marketplace.json @@ -265,7 +265,7 @@ jobs: needs: [meta, build] permissions: { id-token: write, attestations: write, contents: read } uses: >- - attested-delivery/.github/.github/workflows/reusable-vex.yml@698148e12da113cfeeef8742c31ae93657959e67 + attested-delivery/.github/.github/workflows/reusable-vex.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0 with: subject-name: ${{ needs.build.outputs.subject-name }} subject-digest: ${{ needs.build.outputs.subject-digest }}