mroot/yazi
1
0
Fork 0
mirror of https://github.com/sxyazi/yazi.git synced 2026-07-23 07:41:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 7

ci: pin winget-releaser to a full commit SHA

Browse source 
The winget job hands WINGET_TOKEN to vedantmgoyal9/winget-releaser via the
mutable @main branch. Pin to the v2 release commit so the publishing
credential is only ever exposed to a fixed, reviewed version of the action.

Signed-off-by: kobihikri <kobi.hikri@gmail.com>
This commit is contained in:
kobihikri 2026-07-14 12:12:20 +03:00
parent b25ae9f82d
commit f96cf25189
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.github/workflows/publish.yml vendored
View file

@ -16,7 +16,7 @@ jobs:
merge-multiple: true
- name: Publish to Winget
uses: vedantmgoyal9/winget-releaser@main
uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
with:
identifier: sxyazi.yazi
installers-regex: 'yazi-(x86_64|aarch64)-pc-windows-msvc\.zip$'